An unauthenticated SQL injection vulnerability in Homey BNB V4 allows remote attackers to execute arbitrary database queries and potentially bypass authentication mechanisms.

The application fails to properly sanitize user-supplied input across multiple endpoints, including the admin/getrecord.php and rooms/ajax_refresh_subtotal scripts. These flaws allow unauthenticated attackers to inject malicious SQL commands, leading to unauthorized data extraction or administrative bypass.

The ability for an unauthenticated attacker to manipulate backend database queries poses a severe risk to the confidentiality and integrity of the system. Successful exploitation could result in the total compromise of sensitive user information, administrative credentials, and booking data. With a CVSS score of 8.2, this vulnerability represents a high-severity threat that could lead to significant data breaches and long-term reputational damage.

Immediate Action: As no official vendor patch is identified, administrators should restrict public access to the application's administrative interface and implement strict input validation on all GET and POST parameters.

Proactive Monitoring: Monitor server access logs for anomalous GET requests containing SQL syntax, such as UNION, SLEEP, or comment characters, directed at the admin or ajax endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to mitigate the risk of exploitation while a permanent code-level fix is developed.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 46616.

Given the high CVSS score and the public availability of exploit scripts, this vulnerability requires immediate attention. Organizations utilizing Homey BNB V4 must prioritize the implementation of compensating controls, such as WAF filtering, and should evaluate the necessity of migrating to a secure, actively maintained platform if the vendor does not provide a remediation path.