An unauthenticated SQL injection vulnerability in Ashop Shopping Cart Software allows attackers to extract sensitive database information through the manipulation of administrative queries.

This is a time-based blind SQL injection flaw (CWE-89) occurring in the admin/bannedcustomers.php file. An attacker can submit crafted POST requests containing SQL payloads to the blacklistitemid parameter, leveraging time-delay functions to exfiltrate data from the underlying database.

The vulnerability poses a severe risk to the confidentiality of organizational data. Successful exploitation allows an attacker to bypass standard security controls to extract sensitive information from the backend database, potentially leading to unauthorized access to customer records, administrative credentials, or proprietary business data. Given the CVSS score of 8.2, this represents a high-severity threat that requires immediate attention to prevent data compromise.

Immediate Action: As no official vendor patch is available, administrators should restrict network access to the admin/bannedcustomers.php endpoint to authorized personnel only. If the functionality is not business-critical, disable the affected script entirely.

Proactive Monitoring: Security teams should monitor web access logs for anomalous POST requests to the admin/bannedcustomers.php endpoint, specifically looking for patterns involving SQL keywords or abnormal execution times.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection signatures, particularly those targeting the blacklistitemid parameter.

Public Exploit Available: Yes, a functional proof-of-concept exists via the Exploit-DB entry 46681.

The presence of a public proof-of-concept combined with the severity of SQL injection makes this a significant risk. Because an official patch is unavailable, organizations must prioritize the implementation of compensating controls, such as WAF filtering and strict access control, to mitigate the risk of unauthorized database access. Regular review of administrative access paths is advised until the vendor provides a secure update.