Homey BNB V4 is susceptible to multiple unauthenticated SQL injection vulnerabilities that enable attackers to bypass authentication and extract sensitive database information.

The application fails to sanitize user supplied input across multiple endpoints, including the admin/getcmsdata.php script. This flaw allows unauthenticated attackers to inject malicious SQL commands to bypass administrative authentication or exfiltrate data from the underlying database.

The presence of SQL injection vulnerabilities poses a severe risk to the confidentiality and integrity of the application. An attacker can gain unauthorized access to the administrative dashboard, potentially leading to a complete compromise of the platform, unauthorized data access, and significant reputational damage. With a CVSS score of 8.2, this vulnerability represents a high risk that requires immediate attention to prevent exploitation.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict public access to the administrative interface immediately and disable the affected PHP scripts if they are not essential for site operations.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax, such as "UNION SELECT", "SLEEP", or tautologies, directed at the /admin/ or /rooms/ajax_refresh_subtotal endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to mitigate the risk until the software can be updated or replaced.

Public Exploit Available: Yes, a published proof of concept exists via ExploitDB (EDB-ID: 46616).

Given the critical nature of these SQL injection flaws and the existence of public exploit code, organizations running Homey BNB V4 are at high risk of compromise. It is strongly recommended to audit the application for these vulnerabilities and implement strict network level restrictions to prevent unauthorized access to the administrative panel while a permanent fix is sought.