A critical SQL injection vulnerability in Alienor Web Libre 2.0 allows unauthenticated attackers to execute arbitrary database queries, posing a significant risk of data exfiltration.

This is an SQL injection vulnerability (CWE-89) located in the identifiant parameter of the index.php script. An unauthenticated attacker can submit crafted POST requests containing malicious SQL payloads to extract sensitive database contents, including usernames and version details.

The ability for an unauthenticated user to interact directly with the backend database represents a severe security failure. Successful exploitation could lead to the total compromise of sensitive user information, administrative credentials, or application configuration data. Given the CVSS score of 8.2, this vulnerability should be treated as a high-priority risk due to the ease of exploitation and the potential for complete data exposure.

Immediate Action: As no official vendor patch is currently identified, administrators should restrict network access to the affected instance or disable the application until a secure version is available.

Proactive Monitoring: Review web server access logs for anomalous POST requests to index.php that contain SQL syntax, such as SELECT, UNION, or OR operators, within the identifiant field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and sanitize input to the identifiant parameter.

Public Exploit Available: Yes, a functional exploit is available via the Exploit Database (EDB-ID: 45827).

Due to the availability of a public exploit and the lack of a vendor-provided patch, this vulnerability presents a clear and present danger to affected environments. Organizations currently running Alienor Web Libre 2.0 must prioritize the isolation of this application from the public internet. If the application is required for business operations, implement strict WAF filtering and rigorous database monitoring to detect and block malicious injection attempts immediately.