An unauthenticated SQL injection vulnerability in Web Wiz Forums 12.01 allows remote attackers to exfiltrate sensitive data from the underlying database.

The application fails to properly sanitize the PF parameter within the member_profile.asp script. This allows an unauthenticated attacker to inject malicious SQL commands via GET requests, leading to unauthorized database query execution.

Successful exploitation of this vulnerability permits unauthorized access to the backend database, which may contain sensitive user information and system configuration data. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to significant data breaches, loss of customer trust, and potential regulatory non-compliance.

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the affected script or disable the vulnerable profile functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting member_profile.asp, specifically looking for SQL syntax patterns within the PF parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in URL parameters.

Public Exploit Available: Yes, a functional exploit is available via the Exploit-DB entry (EDB-ID: 47284).

Due to the ease of exploitation and the potential for unauthorized data access, this vulnerability poses a significant risk to affected environments. Organizations must treat this as a high-priority item and implement immediate compensating controls, such as WAF filtering, to mitigate the risk while awaiting official vendor remediation.