An unauthenticated SQL injection vulnerability in iScripts ReserveLogic permits remote attackers to extract sensitive database information via crafted POST requests.

The application fails to properly sanitize the jqSearchDestination parameter within the search endpoint, allowing an unauthenticated attacker to inject malicious SQL commands. This flaw enables unauthorized interaction with the backend database through standard HTTP POST requests.

The ability for an unauthenticated user to perform SQL injection poses a severe risk to data confidentiality and integrity. With a CVSS score of 8.2, this vulnerability could allow attackers to bypass authentication mechanisms, exfiltrate sensitive customer or system data, and potentially compromise the entire database environment, leading to significant reputational damage and regulatory non-compliance.

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the affected search endpoint via network segmentation or by disabling the vulnerable search functionality if it is not business critical.

Proactive Monitoring: Monitor web server logs for irregular POST requests directed at the search endpoint, specifically looking for SQL syntax patterns or unexpected character sequences in the jqSearchDestination parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets designed to detect and block common SQL injection patterns targeting the application search parameters.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the Exploit-DB entry 46640.

Due to the high severity of this SQL injection vulnerability and the availability of public exploit material, it is imperative that organizations using iScripts ReserveLogic take immediate steps to secure their environment. If a vendor update is not available, implement robust input validation or WAF rules to sanitize the search parameters and prevent unauthorized database access.