A critical SQL injection vulnerability in DIGIT CENTRIS ERP allows unauthenticated remote attackers to execute arbitrary database queries, posing a severe risk of unauthorized data access.

The application fails to properly sanitize user input in the datum1, datum2, KID, and PID parameters within POST requests sent to the /korisnikinfo.php endpoint. This allows unauthenticated attackers to inject malicious SQL syntax to extract or modify sensitive information from the underlying database.

The vulnerability carries a CVSS score of 8.2, reflecting a high severity due to the lack of required authentication and the potential for significant data exposure. Successful exploitation could lead to full database compromise, resulting in the theft of sensitive business intelligence, user credentials, or personally identifiable information, causing severe reputational and financial damage.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /korisnikinfo.php endpoint to authorized internal segments only. If the functionality is not business critical, disable the affected script entirely until a vendor resolution is released.

Proactive Monitoring: Monitor web server access logs for suspicious POST requests to /korisnikinfo.php containing SQL-specific characters, such as single quotes, double quotes, or comment syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block SQL injection patterns in POST parameters. This will provide a critical layer of defense against exploitation attempts while waiting for a formal patch.

Public Exploit Available: Yes, a public exploit exists as documented on Exploit-DB (EDB-ID: 47401).

Given the availability of a public exploit and the lack of a vendor-provided patch, this vulnerability presents an elevated risk to the organization. Security teams must prioritize identifying all instances of DIGIT CENTRIS ERP within their environment and implement the recommended WAF and network access restrictions immediately to prevent unauthorized database access.