An unauthenticated SQL injection vulnerability in WebOfisi E-Ticaret 4.0 allows remote attackers to compromise the backend database and execute arbitrary commands.

The application fails to properly sanitize the urun GET parameter before using it in database queries. This flaw allows unauthenticated attackers to perform various SQL injection techniques, including boolean-based blind, error-based, time-based blind, and stacked queries.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive customer data, administrative credentials, or full database compromise. Given the CVSS score of 8.2, this represents a high-severity risk that could result in significant data breaches, loss of customer trust, and potential regulatory non-compliance.

Immediate Action: As no official vendor patch is currently confirmed, administrators should immediately restrict access to the vulnerable endpoint or transition to a secure, supported e-commerce platform.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax, such as sleep commands, union selects, or unexpected characters in the urun parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the urun parameter.

Public Exploit Available: Yes, a functional proof-of-concept for this vulnerability is documented in the Exploit Database (EDB-ID 45897).

Due to the high severity of this SQL injection flaw and the public availability of exploit code, immediate mitigation is required. Organizations using WebOfisi E-Ticaret 4.0 must prioritize implementing WAF protections or disabling the vulnerable functionality to prevent potential database exfiltration until a permanent resolution is achieved.