An unauthenticated SQL injection vulnerability in Netartmedia PHP Car Dealer allows remote attackers to execute arbitrary database queries, creating a critical risk of data exfiltration.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize the features[] parameter in POST requests sent to index.php. This allows unauthenticated remote attackers to inject malicious SQL payloads to manipulate database queries or extract sensitive information.

Successful exploitation allows an unauthorized party to gain access to the underlying database, which may contain sensitive customer data, inventory information, or administrative credentials. Given the CVSS score of 8.2, this vulnerability poses a high risk to business continuity and data privacy. Unauthorized database manipulation could also lead to the integrity loss of the entire application platform.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected index.php endpoint or disable the vulnerable feature if it is not business-critical.

Proactive Monitoring: Monitor web server logs for POST requests containing suspicious SQL syntax or anomalies in the features[] parameter. Review database query logs for unusual or unauthorized access patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rules designed to detect and block SQL injection attempts targeting the features[] parameter.

Public Exploit Available: Yes — a published proof-of-concept exploit exists on the Exploit Database (EDB-ID: 46573).

Given the availability of a public exploit and the high severity of the flaw, administrators must treat this vulnerability with extreme urgency. If immediate patching is not possible, implement strict network-level access controls or WAF filtering to prevent unauthenticated access to the vulnerable endpoint until a permanent vendor fix is released.