A time-based blind SQL injection vulnerability in Netartmedia Event Portal 2.0 allows unauthenticated attackers to extract sensitive database information.

The application fails to properly sanitize input within the Email parameter of the loginaction.php endpoint. This allows an unauthenticated attacker to inject malicious SQL commands, enabling time-based blind SQL injection to retrieve data from the backend database.

The exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive information stored within the application database, including user credentials, personal data, or system configuration details. With a CVSS score of 8.2, this vulnerability is classified as High severity, as it provides an attacker with a direct vector to compromise data confidentiality without requiring any prior authentication.

Immediate Action: Review vendor documentation for available security patches and apply them immediately to version 2.0. If no patch is available, contact Netartmedia support to determine the recommended remediation path.

Proactive Monitoring: Monitor server access logs for suspicious POST requests directed at loginaction.php, specifically identifying patterns consistent with SQL injection attempts or anomalous database response times.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads, particularly those containing common SQL keywords or sleep commands, to protect the vulnerable endpoint.

Public Exploit Available: Yes, a proof-of-concept exists via the Exploit-DB entry 46560.

Given the High severity of this vulnerability and the availability of public proof-of-concept code, organizations running Netartmedia Event Portal 2.0 should prioritize immediate remediation. If patching is not feasible, restrict access to the login endpoint or implement strict input validation as a temporary measure to mitigate the risk of unauthorized data exfiltration.