Dodit Solutions Homey BNB V4 contains critical SQL injection vulnerabilities that allow unauthenticated attackers to extract sensitive database information or bypass authentication mechanisms.

The application fails to properly sanitize user-supplied input across multiple GET parameters, including catid, hosting_id, and id. These flaws allow an unauthenticated attacker to execute arbitrary SQL commands against the backend database, including potential authentication bypass on the administrative login page.

Successful exploitation of these vulnerabilities could lead to a complete compromise of the application database, resulting in the unauthorized disclosure of sensitive user or administrative information. Given the CVSS score of 8.2, this represents a high-severity risk that could facilitate unauthorized administrative access and lead to significant data breaches or total system takeover.

Immediate Action: As no official vendor patch is currently identified, administrators should immediately restrict access to the affected web application or take the service offline until a secure version is provided by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous GET requests containing SQL syntax, such as sleep commands or union-based injection patterns, directed at files like admin/cms_getpagetitle.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect incoming traffic and block requests containing malicious payloads targeting the identified parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 46616.

The presence of multiple, easily weaponized SQL injection vulnerabilities makes this a high-priority risk. Organizations currently running Homey BNB V4 must prioritize isolating the application from external networks or applying robust WAF protections to mitigate the threat of unauthorized data extraction and administrative account takeover.