A critical SQL injection vulnerability in edlangley Inventory Webapp allows unauthenticated attackers to execute arbitrary database commands, posing a severe risk of data compromise.

The application fails to properly sanitize input within the name, description, quantity, and cat_id parameters of the add-item.php script. This flaw allows an unauthenticated attacker to inject malicious SQL payloads directly into database queries.

The vulnerability carries a CVSS score of 8.2, reflecting a high severity due to the potential for unauthorized data access and manipulation. Successful exploitation allows an attacker to bypass security controls to read, modify, or delete sensitive information stored within the backend database, potentially leading to a complete compromise of the application data and significant reputational damage.

Immediate Action: As no official patch is currently available, users should restrict network access to the application and disable the affected add-item.php script if it is not business critical.

Proactive Monitoring: Security teams should monitor database logs for suspicious query patterns, such as unexpected syntax errors or unauthorized data retrieval attempts originating from the add-item.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in GET requests directed at the inventory application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the ExploitDB entry 47356.

Given the high severity of this SQL injection flaw and the availability of public exploit code, it is imperative that organizations take immediate steps to secure their deployments. If an official update is not provided by the vendor, we strongly recommend implementing robust WAF filtering and restricting access to the vulnerable interface to prevent exploitation.