An unauthenticated SQL injection vulnerability in WebIncorp ERP exposes the system to unauthorized database information disclosure and potential data manipulation.

This is an SQL injection vulnerability (CWE-89) located in the prod_id parameter of the product_detail.php script. The flaw allows an unauthenticated attacker to manipulate database queries by injecting malicious SQL code into the URL parameter, facilitating unauthorized data extraction.

The ability for an unauthenticated attacker to execute arbitrary SQL commands poses a severe risk to the confidentiality and integrity of the organization's data. With a CVSS score of 8.2, this vulnerability could lead to the total compromise of the ERP database, including sensitive business records and customer information, resulting in significant reputational damage and regulatory non-compliance.

Immediate Action: As no official patch is currently available, organizations should restrict access to the affected product_detail.php script at the network level or disable the vulnerable module if it is not business critical.

Proactive Monitoring: Monitor web server logs for suspicious GET requests containing SQL syntax, such as single quotes, UNION statements, or common SQL keywords, targeting the product_detail.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect incoming traffic and block requests containing malicious payloads directed at the prod_id parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the Exploit-DB entry 47199.

Given the public availability of exploit code and the critical nature of SQL injection, immediate defensive action is required. Organizations using WebIncorp ERP must prioritize implementing WAF rules or network segmentation to prevent exploitation while awaiting further guidance or a permanent fix from the vendor.