A critical SQL injection vulnerability in Phpscriptsmall Fiverr Clone Script 1.2.2 allows unauthenticated remote attackers to compromise the underlying database.

This vulnerability is an SQL injection (CWE-89) flaw located in the page parameter of the application. An unauthenticated attacker can supply crafted SQL syntax to this parameter to execute arbitrary database commands, leading to data exfiltration or unauthorized database modification.

The ability for an unauthenticated user to interact directly with the database poses a severe risk to data confidentiality and integrity. With a CVSS score of 8.2, this high-severity flaw could lead to the total compromise of user credentials, project data, and other sensitive information stored within the application database, resulting in significant reputational damage and potential regulatory non-compliance.

Immediate Action: Users must contact the vendor, Phpscriptsmall, to obtain and apply the latest security update or patch that addresses this SQL injection vulnerability.

Proactive Monitoring: Security teams should implement database activity monitoring to detect anomalous query patterns or unexpected syntax, such as union-based or boolean-based injection attempts, originating from the web application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter and block malicious SQL injection payloads targeting the page parameter before they reach the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in ExploitDB (EDB-ID 46637).

Given the availability of public proof-of-concept code and the ease of exploitation by unauthenticated actors, this vulnerability presents a significant risk to any organization using the affected software. Administrators must prioritize updating to a patched version immediately or disabling the affected functionality until a secure update is applied to prevent unauthorized database access.