Unauthenticated attackers can exploit SQL injection vulnerabilities in Netartmedia PHP Mall 4.1 to gain unauthorized access to sensitive database information.

The application fails to properly sanitize user input in the id parameter of index.php and the Email parameter of loginaction.php. This allows unauthenticated remote attackers to execute time-based blind SQL injection attacks to compromise the backend database.

Successful exploitation of these SQL injection vulnerabilities poses a severe risk to data confidentiality. An attacker can extract sensitive user data, credentials, or proprietary business information stored within the database. With a CVSS score of 8.2, this vulnerability represents a high-severity threat that could lead to full database compromise and significant reputational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script files or implement strict input validation filters for the id and Email parameters. If the software is no longer supported, migration to a secure, actively maintained platform is strongly advised.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected time-based delays. Monitor database query logs for unusual activity or unauthorized data retrieval attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns, such as the use of SLEEP or XOR functions in GET and POST requests.

Public Exploit Available: Yes, a proof-of-concept exists via the Exploit-DB entry 46562.

Given the high CVSS score and the public availability of an exploit, this vulnerability should be treated as a priority. Administrators must immediately implement WAF rules to mitigate the risk while evaluating the necessity of the affected software within their environment, as the lack of a vendor-supplied patch necessitates moving toward decommissioning or replacing the vulnerable application.