An unauthenticated SQL injection vulnerability in Niteosoft Simple Job Script version 1.66 poses a critical risk of unauthorized data extraction and database manipulation.

The application is susceptible to SQL injection (CWE-89) due to improper sanitization of the employerid parameter within the register-recruiters endpoint. An unauthenticated attacker can execute arbitrary SQL commands via POST requests to compromise backend database integrity.

The ability for an unauthenticated attacker to manipulate database queries represents a significant threat to confidentiality and data integrity. With a CVSS score of 8.2, this high-severity flaw could lead to the unauthorized exposure of sensitive recruiter or applicant information, potential administrative account takeover, or the total destruction of stored data, resulting in severe operational disruption and reputational damage.

Immediate Action: As no official patch is currently identified for this legacy issue, administrators should restrict public access to the register-recruiters endpoint or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Security teams should monitor web access logs for unusual POST requests directed at the register-recruiters endpoint, specifically looking for time-based SQL injection patterns or suspicious character sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection attempts targeting the employerid parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up on Exploit-DB (EDB-ID 46612).

Given the public availability of exploit code and the ease of execution, organizations running Niteosoft Simple Job Script must prioritize the mitigation of this flaw. If a vendor-supplied update is not available, immediate network-level restrictions or the implementation of robust WAF filtering is required to prevent potential compromise of the backend database.