An authenticated SQL injection vulnerability in Bdtask Tradebox 5.4 could allow an attacker to compromise sensitive database information.

The application fails to properly sanitize user input in the symbol parameter within the monthly_deposit endpoint. This SQL injection flaw allows an authenticated attacker to execute arbitrary database queries using various techniques, including boolean-based and time-based blind injection.

Successful exploitation of this vulnerability allows an attacker to bypass standard data access controls and exfiltrate sensitive information from the application database. Given the CVSS score of 7.1, this is a high-severity issue that could lead to significant data breaches, unauthorized disclosure of customer trading data, and potential regulatory non-compliance.

Immediate Action: Upgrade to a version of Tradebox where the symbol parameter is properly sanitized and the SQL injection vulnerability is remediated by the vendor.

Proactive Monitoring: Monitor application logs for suspicious POST requests to the monthly_deposit endpoint, specifically looking for SQL syntax patterns or unexpected character sequences in the symbol parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 46671.

This vulnerability represents a significant risk to the integrity and confidentiality of the application database. Organizations using Bdtask Tradebox 5.4 must prioritize applying security updates provided by the vendor. If an immediate patch is not available, implement strict input validation and WAF filtering to mitigate the risk of exploitation.