An unauthenticated SQL injection vulnerability in Zeeways Jobsite CMS poses a critical risk to database confidentiality by allowing remote attackers to execute arbitrary database queries.

This is an SQL Injection vulnerability (CWE-89) affecting the 'id' GET parameter across news_details.php, jobs_details.php, and job_cmp_details.php. The flaw allows an unauthenticated attacker to manipulate database queries using crafted GROUP BY and CASE statements to exfiltrate sensitive data.

Successful exploitation of this vulnerability can lead to the full compromise of the application database, resulting in unauthorized access to sensitive user information, job listings, or administrative credentials. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to significant data breaches and potential reputational damage for organizations relying on this platform.

Immediate Action: As there is no official vendor patch available, administrators should immediately restrict access to the affected PHP files at the web server level or disable the vulnerable CMS modules if possible.

Proactive Monitoring: Security teams should monitor web server logs for anomalous GET requests containing SQL syntax patterns, such as "GROUP BY", "CONCAT", or "CASE", directed at the identified vulnerable scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the 'id' parameter to provide virtual patching until the software is updated or replaced.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 46602.

Due to the lack of an official vendor patch and the presence of a publicly available exploit, this vulnerability presents an elevated and ongoing risk to any organization running Zeeways Jobsite CMS. Organizations should prioritize migrating away from this unsupported software or implementing strict network-level access controls to isolate the application from untrusted traffic until a secure alternative is deployed.