A critical SQL injection vulnerability in OpenBiz Cubi Lite 3.0.8 allows unauthenticated attackers to compromise sensitive database information via the login interface.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize user input in the username parameter of the login form. An unauthenticated attacker can exploit this by sending a crafted POST request to the bin/controller.php endpoint to execute arbitrary SQL commands.

Successful exploitation allows unauthorized parties to extract sensitive data from the backend database, potentially leading to a full breach of user credentials or system configuration information. With a CVSS score of 8.2, this vulnerability represents a high risk to the confidentiality and integrity of the application, as it provides a direct path for attackers to bypass authentication mechanisms.

Immediate Action: Since no official patch is available for this legacy software, administrators should restrict access to the affected web interface or decommission the application immediately.

Proactive Monitoring: Review web server access logs for anomalous POST requests to bin/controller.php, specifically monitoring for SQL syntax keywords such as SELECT, UNION, or SLEEP.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in POST request parameters.

Public Exploit Available: Yes, a published proof-of-concept exists in the form of a technical write-up on Exploit-DB (EDB-ID: 45801).

Due to the lack of vendor-supplied patches and the ease of exploitation, the risk associated with this vulnerability is high. Organizations still utilizing OpenBiz Cubi Lite 3.0.8 are strongly advised to migrate to a supported platform, as the application is inherently insecure in its current state.