An unauthenticated SQL injection vulnerability in Snowhall Silurus Classifieds Script 2.0 allows remote attackers to extract sensitive information from the underlying database.

This vulnerability is an SQL injection (CWE-89) located in the wcategory.php script. Unauthenticated attackers can inject malicious SQL payloads via the ID parameter to bypass application logic and perform unauthorized data exfiltration.

Successful exploitation of this flaw can lead to a complete compromise of the application database. An attacker can extract sensitive system information, user data, or configuration details, potentially leading to further unauthorized access or total system takeover. With a CVSS score of 8.2, this vulnerability represents a high risk to data confidentiality and integrity.

Immediate Action: There is currently no official patch available from the vendor. Organizations should immediately restrict access to the affected script or migrate to a more secure, supported platform.

Proactive Monitoring: Review web server access logs for anomalous GET requests to wcategory.php containing SQL syntax characters, such as single quotes, UNION, or SELECT statements.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious input directed at the ID parameter.

Public Exploit Available: Yes, a functional proof-of-concept exists via the Exploit Database (EDB-ID: 45838).

Given the lack of a vendor-provided patch and the availability of a public exploit, this software should be considered insecure for production use. Organizations currently running version 2.0 of Silurus Classifieds Script must move to disable the affected functionality or transition to a supported alternative immediately to prevent potential data breaches.