A critical SQL injection vulnerability in Niteosoft Simple Job Script allows unauthenticated attackers to manipulate database queries, posing a significant risk of data exfiltration.

The application fails to properly sanitize user input in the job_id parameter of the get_job_applications_ajax.php endpoint. This allows an unauthenticated attacker to inject malicious SQL commands directly into the database query structure.

The vulnerability carries a CVSS score of 8.2, which reflects the high potential for unauthorized data access and manipulation. Successful exploitation could allow an attacker to bypass authentication mechanisms, extract sensitive user or applicant data, or modify database records, leading to severe reputational damage and potential regulatory non-compliance.

Immediate Action: Administrators must update to the latest available version of Simple Job Script that addresses this flaw. If a direct patch is not available, remove or restrict access to the vulnerable get_job_applications_ajax.php script.

Proactive Monitoring: Review web server and database logs for anomalous POST requests to the ajax-related endpoints containing SQL syntax fragments.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting script parameters.

Public Exploit Available: Yes, a public proof-of-concept exploit is available via Exploit-DB (EDB-ID: 46612).

Given the availability of public exploit code and the critical nature of SQL injection, this vulnerability poses a severe risk to the integrity and confidentiality of the application database. Organizations using Niteosoft Simple Job Script must prioritize patching this flaw immediately to prevent unauthorized database access.