A critical vulnerability in Alive Parish 2.0.4 allows unauthenticated attackers to execute arbitrary SQL commands and achieve remote code execution via malicious file uploads.

The application suffers from SQL injection in the search endpoint through the key parameter and an arbitrary file upload vulnerability in the person photo upload functionality. Both flaws are exploitable by unauthenticated attackers.

The ability to execute arbitrary SQL queries allows an attacker to extract sensitive data, modify database contents, or bypass authentication mechanisms. Furthermore, the arbitrary file upload vulnerability provides a direct vector for full system compromise via remote code execution. Given the CVSS score of 8.2, this represents a high-severity threat that could lead to complete loss of confidentiality and integrity of the application environment.

Immediate Action: There is no official patch available for this software. Administrators should immediately restrict access to the application or disable the vulnerable search and photo upload features until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the search endpoint with SQL syntax or unusual file extensions in the images/uploaded directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and restrict file uploads to verified image types only.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the ExploitDB entry 45840.

Due to the lack of an official vendor patch and the presence of a functional proof-of-concept, this vulnerability poses a significant risk to the integrity of the host system. Organizations currently running Alive Parish 2.0.4 must prioritize isolating these instances from the public internet or decommissioning the software if it cannot be adequately secured through compensating controls.