Version 1.11 of the html5_snmp application is vulnerable to multiple SQL injection flaws that could allow an authenticated attacker to extract or modify sensitive database information.

The application is susceptible to SQL injection (CWE-89) within the Router_ID (POST) and Router_IP (GET) parameters. An authenticated attacker can leverage error-based, time-based, or union-based injection techniques to execute arbitrary database queries.

Successful exploitation of these SQL injection vulnerabilities provides an attacker with the ability to interact directly with the backend database. This could lead to unauthorized disclosure of sensitive records, modification of data, or in some configurations, potential remote code execution via database-level file operations. Given the CVSS score of 7.1, this represents a significant risk to the confidentiality and integrity of the application environment.

Immediate Action: There is no official patch available for this legacy software. Organizations should immediately restrict access to the application or discontinue its use until the vulnerabilities are remediated by the maintainer.

Proactive Monitoring: Review web server and database logs for anomalous patterns, such as unexpected SQL syntax errors, unusually long execution times, or attempts to access system tables like INFORMATION_SCHEMA.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect incoming traffic and block malicious payloads directed at the Router_ID and Router_IP parameters.

Public Exploit Available: Yes, a public exploit is available via the Exploit Database (EDB-ID 47588).

Due to the presence of documented public exploits and the high severity of SQL injection, this vulnerability poses a clear and present danger to affected systems. Because an official patch is unavailable, the most effective mitigation is to isolate the affected software from network access or replace it with a secure alternative. Security teams should prioritize identifying any instances of this software within their inventory to prevent unauthorized database access.