An unauthenticated SQL injection vulnerability in Webiness Inventory 2.3 enables remote attackers to extract sensitive information from the underlying database.

This is an SQL injection vulnerability (CWE-89) located in the WsModelGrid.php script. Unauthenticated attackers can inject malicious SQL code through the order parameter via POST requests to extract sensitive data, including database versions and user information.

The ability for an unauthenticated attacker to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity. With a CVSS score of 8.2, this vulnerability could lead to the total compromise of the application database, resulting in the unauthorized exposure of sensitive business data, credentials, or system configurations.

Immediate Action: There is no official patch provided by the vendor; users should immediately restrict access to the application or migrate to a supported, secure alternative.

Proactive Monitoring: Security teams should monitor web access logs for anomalous POST requests directed at the WsModelGrid.php endpoint that contain SQL syntax or encoded payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting the order parameter in POST requests.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the Exploit-DB entry 45843.

Given the high CVSS score and the public availability of exploit code, this vulnerability presents a significant security risk. Administrators must ensure that the affected Webiness Inventory instance is not exposed to the public internet and should pursue decommissioning or replacing the software, as no vendor patch is available to remediate the underlying flaw.