An unauthenticated SQL injection vulnerability in Niteosoft Simple Job Script (version 1.66) allows remote attackers to compromise backend database integrity and extract sensitive information.

The application fails to properly neutralize special elements in an SQL command within the delete_application_ajax.php script. An unauthenticated attacker can send malicious POST requests containing crafted SQL payloads via the app_id parameter to interact directly with the database.

Successful exploitation allows an attacker to bypass authentication, extract sensitive data, or modify database contents without authorization. Given the CVSS score of 8.2, this vulnerability poses a high risk to business operations, potentially leading to unauthorized disclosure of user information, loss of data integrity, and significant reputational damage.

Immediate Action: As no official vendor patch is currently available, users should restrict network access to the affected script or disable the vulnerable functionality if it is not required for business operations.

Proactive Monitoring: Monitor web server access logs for suspicious POST requests targeting the delete_application_ajax.php endpoint, specifically looking for unusual character patterns or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting the app_id parameter.

Public Exploit Available: Yes — the Exploit-DB entry 46612 provides a functional proof-of-concept for this vulnerability.

This vulnerability presents a high risk due to the potential for unauthorized database manipulation and the availability of public exploit code. Organizations using Niteosoft Simple Job Script must prioritize the implementation of compensating controls, such as WAF rules, and monitor for unauthorized access attempts until a formal security update is provided by the vendor.