An unauthenticated SQL injection vulnerability in Pedidos 1.0 permits remote attackers to execute arbitrary database queries and extract sensitive information from the backend database.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize user input in the q parameter of the ajax/load_proveedores.php file. This flaw allows an unauthenticated attacker to inject malicious SQL commands directly into the database query, enabling unauthorized access to schema names, table structures, and potentially stored data.

This vulnerability poses a significant risk to data confidentiality and integrity. By successfully exploiting this flaw, an attacker can exfiltrate the entire contents of the database, leading to potential data breaches, unauthorized disclosure of sensitive business information, and potential administrative account compromise. Given the CVSS score of 8.2, this is considered a high severity issue that requires immediate attention to prevent full database exposure.

Immediate Action: As no official patch is available for this legacy software, users should immediately restrict network access to the application or disable the vulnerable ajax/load_proveedores.php endpoint if it is not business-critical.

Proactive Monitoring: Security teams should review web server access logs for suspicious GET requests containing SQL syntax or encoded characters within the q parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the identified endpoint.

Public Exploit Available: Yes, a functional proof-of-concept exists via the Exploit-DB entry 45856.

The presence of a publicly available exploit combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations utilizing Pedidos 1.0 are strongly urged to isolate the application from the public internet or replace the software entirely, as it lacks a vendor-supported security update path.