An unauthenticated SQL injection vulnerability in Wecodex SAT CFDI 3.3 exposes the underlying database to unauthorized data extraction and manipulation.

The application fails to properly sanitize user-supplied input within the id parameter of the signIn endpoint. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands, including blind and time-based payloads, directly against the backend database.

The ability for an unauthenticated attacker to perform SQL injection poses a severe risk to data confidentiality and integrity. With a CVSS score of 8.2, this vulnerability could be leveraged to dump entire database contents, bypass authentication mechanisms, or potentially modify critical business records, leading to significant operational disruption and regulatory non-compliance.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the signIn endpoint via network-level controls or a Web Application Firewall (WAF) until the vendor provides a secure update.

Proactive Monitoring: Review web server and database logs for anomalous patterns, such as unexpected SQL syntax, time delays in server responses, or unusual character strings originating from the signIn endpoint.

Compensating Controls: Deploy a WAF with specific rules to detect and block SQL injection patterns, such as stacked queries or sleep commands, targeting the application sign-in process.

Public Exploit Available: Yes, a published proof-of-concept exists in the Exploit Database (EDB-ID: 44726).

Given the availability of public exploit code and the critical nature of SQL injection, this vulnerability represents a high risk to the organization. Administrators must prioritize the implementation of WAF rules to sanitize input at the perimeter and seek alternative secure authentication methods if a vendor patch remains unavailable.