An unauthenticated SQL injection vulnerability in Wecodex Shipping System CMS 1.0 allows remote attackers to bypass authentication and gain unauthorized access to administrative functions.

This vulnerability is an SQL injection flaw residing in the username parameter of the admin login endpoint. An unauthenticated attacker can exploit this by injecting boolean-based blind SQL payloads to bypass authentication mechanisms.

The ability for an unauthenticated attacker to bypass administrative login credentials presents a critical risk to the confidentiality and integrity of the system. Successful exploitation allows unauthorized access to the backend management console, potentially leading to full database compromise or data exfiltration. Given the CVSS score of 8.2, this vulnerability is considered a high-priority risk that could result in significant operational disruption and data exposure.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the administrative login page using IP whitelisting or VPN requirements.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests to the admin login endpoint containing SQL syntax characters, such as single quotes, parentheses, or RLIKE keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns directed at the authentication parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 44722.

Due to the absence of a vendor-supplied patch, this vulnerability poses a persistent risk to any instance of Shipping System CMS 1.0. Organizations should immediately isolate the administrative interface from the public internet and implement robust WAF filtering to mitigate the threat of credential bypass. Until a vendor-provided update is released, the system must be considered compromised if exposed to untrusted networks.