A critical SQL injection vulnerability in Homey BNB V4 allows unauthenticated attackers to manipulate database queries, posing a severe risk to data integrity and system access.

The application is susceptible to SQL injection via multiple GET parameters, including the id parameter in the admin/edit.php file, which allows unauthenticated attackers to perform time-based data extraction or bypass authentication entirely.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive application data, including user credentials and administrative information. Given the CVSS score of 8.2, this represents a high-severity risk that could facilitate full database compromise, leading to significant reputational damage and potential regulatory non-compliance regarding data privacy.

Immediate Action: As no official patch is currently available for this legacy script, administrators should immediately restrict access to the administration panel via network-level controls and consider migrating to a more secure, actively maintained platform.

Proactive Monitoring: Security teams should review web server logs for anomalous GET requests containing SQL syntax or database-specific functions like SLEEP, particularly targeting administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect incoming traffic and block malicious payloads directed at the identified vulnerable parameters.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the Exploit-DB entry 46616.

The presence of multiple SQL injection points combined with an available proof-of-concept makes this a high-priority risk. Because no vendor patch is available, organizations using this software must treat the installation as compromised or inherently insecure, prioritizing the implementation of robust WAF rules and immediate migration to a secure alternative to eliminate the exposure.