A critical SQL injection vulnerability in Arixolab Nominas 0.27 allows unauthenticated remote attackers to extract sensitive database information.

The application is susceptible to a UNION-based SQL injection vulnerability within the username parameter of the login/checklogin.php script. This flaw allows an unauthenticated attacker to inject malicious SQL commands to retrieve administrative credentials, database names, and system version details.

The exploitation of this vulnerability poses a significant risk to data confidentiality, as it allows unauthorized access to the underlying database. Successful extraction of database contents may lead to further system compromise, loss of sensitive user information, or total service disruption. While the CVSS score is 8.2, the ability for an unauthenticated attacker to extract database information elevates the urgency for immediate mitigation.

Immediate Action: As no official patch is available for this legacy software, users should immediately restrict access to the login/checklogin.php endpoint or disable the Nominas application until a secure alternative is implemented.

Proactive Monitoring: Security teams should monitor web access logs for anomalous POST requests to the login/checklogin.php endpoint, specifically looking for SQL keywords like UNION, SELECT, or concatenation functions in the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes, a functional proof-of-concept exists as detailed in the Exploit-DB entry 45820.

Given the availability of a public exploit and the lack of a vendor-provided patch, this vulnerability presents a high risk to any environment running Nominas 0.27. Organizations are strongly advised to decommission this software if it is no longer actively maintained or to implement strict network-level access controls to prevent unauthenticated access to the vulnerable login interface.