A critical SQL injection vulnerability in Wecodex Online Store System CMS 1.0 allows unauthenticated attackers to extract sensitive database information.

The application fails to properly sanitize user-supplied input in the email parameter of the index.php script when the action parameter is set to clientaccess. This vulnerability allows an unauthenticated attacker to inject SQL payloads, including boolean-based or time-based blind SQL injection, to query and extract data from the underlying database.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive business data, including customer records, authentication credentials, or other proprietary information stored within the database. Given the 8.2 CVSS score, this represents a significant risk to data confidentiality and integrity. The ability for unauthenticated actors to execute these queries remotely poses a severe threat to the security posture of any organization hosting this software.

Immediate Action: As there is no official patch available from the vendor, organizations should immediately restrict access to the vulnerable endpoint or remove the affected software from production environments.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to index.php containing SQL syntax characters, such as single quotes, RLIKE, or SLEEP commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the email parameter in POST requests.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the Exploit-DB entry 44719.

The presence of a functional proof-of-concept and the lack of a vendor-provided patch make this an urgent security concern. Organizations currently utilizing Wecodex Online Store System CMS 1.0 must prioritize migrating to a more secure platform or implementing strict network-level access controls to prevent unauthorized interaction with the vulnerable application.