A critical SQL injection vulnerability in Blondish PHPads 2.0 allows unauthenticated attackers to execute arbitrary database queries and potentially exfiltrate sensitive data.

The application fails to properly sanitize user-supplied input in the bannerID parameter of the click.php3 script. This flaw allows an unauthenticated attacker to inject malicious SQL commands, such as those utilizing the extractvalue function, to gain unauthorized access to database contents.

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to the confidentiality and integrity of the application database. Successful exploitation could lead to the exposure of sensitive user data, configuration details, or other proprietary information stored within the backend. Given the CVSS score of 7.1, this vulnerability represents a high-risk entry point that could be leveraged for further network compromise.

Immediate Action: As no official patch is currently identified, administrators should restrict public access to the vulnerable click.php3 script or disable the affected banner functionality until a secure version is provided by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax or unusual characters directed at the click.php3 endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block SQL injection patterns, specifically targeting requests that include SQL comments or database function calls.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up on Exploit-DB (EDB-ID 46798).

Given the availability of a public proof-of-concept and the ease of exploitation, immediate action is required to mitigate this risk. Organizations should prioritize isolating the affected component or applying strict input validation controls to prevent unauthorized database access until a formal vendor update is released.