An SQL injection vulnerability in the Adianti Framework allows authenticated attackers to perform unauthorized database modifications and gain administrative privileges.

This is an SQL injection flaw (CWE-89) within the SystemProfileForm class. An authenticated attacker can inject malicious SQL code through the name field during profile updates to modify user credentials, including those of administrative accounts.

Successful exploitation of this vulnerability allows an authenticated attacker to perform a full account takeover, including administrative accounts. This results in unauthorized access to sensitive application data, potential system-wide configuration changes, and a complete compromise of the application's integrity. With a CVSS score of 7.1, the risk is categorized as High, reflecting the significant impact on confidentiality and integrity.

Immediate Action: Update to the latest version of the Adianti Framework, ensuring that the patched versions address the SQL injection vulnerability in the SystemProfileForm component.

Proactive Monitoring: Review application access logs for unusual SQL syntax or unexpected changes to administrative user profiles.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious payloads directed at the profile edit endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the ExploitDB entry (EDB-ID: 46217).

Given the availability of a public exploit and the high severity of potential account takeover, organizations using the affected versions of the Adianti Framework should prioritize updating their systems immediately. If an immediate patch is not feasible, restrict access to the affected profile modification functionality until the vendor-supplied fix is deployed.