An unauthenticated SQL injection vulnerability in Niteosoft Simple Job Script version 1.66 poses a critical risk of database compromise and unauthorized data extraction.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89). Unauthenticated attackers can send malicious POST requests to the searched endpoint, specifically targeting the landing_location parameter, to manipulate backend database queries.

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms and extract sensitive information from the application database. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to full loss of confidentiality regarding user data, job applications, or recruiter credentials.

Immediate Action: Update Niteosoft Simple Job Script to a version containing the official patch, or disable the vulnerable application if an update is not immediately available.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to the searched endpoint containing SQL syntax characters, such as single quotes, semicolons, or comments.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP request parameters.

Public Exploit Available: Yes, a functional proof-of-concept exploit is available via ExploitDB (EDB-ID: 46612).

The severity of this vulnerability is elevated by the ease of exploitation and the lack of authentication requirements. Organizations utilizing Simple Job Script version 1.66 must prioritize patching or isolating the affected system immediately to prevent unauthorized database access.