An unauthenticated SQL injection vulnerability in Mediasoftpro ASP.NET jVideo Kit 1.0 allows remote attackers to compromise database integrity and confidentiality.

This is a classic SQL injection (CWE-89) flaw located in the search functionality. Unauthenticated attackers can inject malicious SQL payloads into the 'query' parameter via GET or POST requests to the /search endpoint to perform blind or error-based data extraction.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, potentially leading to the theft of sensitive user data, application credentials, or configuration details. Given the CVSS score of 8.2, this vulnerability represents a high risk to business operations, as it facilitates data exfiltration without requiring any prior authentication or user interaction.

Immediate Action: As no official patch is currently available, users should restrict access to the affected search endpoint via network controls or disable the search functionality entirely until a vendor-supplied update is released.

Proactive Monitoring: Security teams should audit web server access logs for anomalous GET or POST requests to the /search endpoint containing SQL syntax characters such as single quotes, semicolons, or common SQL keywords like UNION, SELECT, and CHAR.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the 'query' parameter.

Public Exploit Available: Yes, a published proof-of-concept exists in the Exploit-DB (EDB-ID 44739).

Due to the lack of a vendor-provided patch and the availability of a public exploit, this vulnerability poses an elevated risk to any organization running Mediasoftpro ASP.NET jVideo Kit 1.0. Organizations should prioritize isolating the affected application from public internet access or implementing strict WAF filtering to prevent unauthorized database queries.