An unauthenticated SQL injection vulnerability in FreeSMS 2.1.2 allows remote attackers to bypass authentication and gain full control over user accounts.

This vulnerability is a boolean-based blind SQL injection occurring in the password parameter of the login endpoint at /pages/crc_handler.php?method=login. An unauthenticated attacker can inject malicious SQL commands to bypass authentication and subsequently use the profile update function to modify account passwords.

Successful exploitation of this vulnerability allows an unauthenticated actor to bypass authentication, effectively gaining unauthorized access to the application. Once authenticated, the attacker can leverage the profile update function to reset passwords for any known user, including administrative accounts. This leads to a total compromise of user data and administrative control over the educational management system, posing significant risks to data integrity and privacy. The CVSS score of 8.2 reflects the high severity of this remote, unauthenticated access vector.

Immediate Action: There is no official patch available for FreeSMS 2.1.2. Organizations should discontinue the use of this software or implement strict network-level access controls to restrict access to the login endpoint to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting /pages/crc_handler.php that contain SQL syntax, such as RLIKE or SELECT statements, in the password parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, specifically targeting boolean-based injection attempts in login fields.

Public Exploit Available: Yes, a public proof-of-concept exists via the Exploit-DB entry 46658.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant security risk. Because no vendor patch is available, organizations must treat this as a critical exposure. It is strongly recommended to isolate the affected instance from the public internet or decommission the software entirely to prevent unauthorized access and potential data compromise.