A critical SQL injection vulnerability in Web Ofisi Platinum E-Ticaret v5 allows unauthenticated attackers to compromise sensitive database information through malicious queries.

The application fails to properly sanitize user input in the 'q' parameter of the ajax/productsFilterSearch endpoint, allowing an unauthenticated attacker to execute arbitrary SQL commands. This flaw permits the use of time-based blind SQL injection techniques to exfiltrate data from the underlying database.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive business and customer information stored within the application database. Given the CVSS score of 8.2, this represents a significant risk to data confidentiality and regulatory compliance, potentially resulting in severe reputational damage and financial loss.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the affected ajax/productsFilterSearch endpoint or disable the vulnerable search functionality entirely until a vendor-supplied fix is available.

Proactive Monitoring: Review web server and database logs for anomalous request patterns, specifically looking for time-delayed responses or suspicious SQL syntax within the 'q' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting the 'q' parameter in POST requests.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 47140.

Due to the high severity of this SQL injection vulnerability and the availability of public exploit code, immediate mitigation is required to protect the application database. Organizations using Web Ofisi Platinum E-Ticaret v5 must prioritize the implementation of compensating controls, such as WAF rules, and seek direct guidance from the vendor regarding a permanent security patch.