A critical SQL injection vulnerability in PilusCart 1.4.1 allows unauthenticated attackers to exfiltrate sensitive database contents.

The application fails to properly sanitize user input in the send parameter during comment submission. An unauthenticated attacker can inject malicious SQL queries into this parameter to manipulate backend database operations and perform data extraction.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, which may contain customer information, administrative credentials, or store configurations. Given the CVSS score of 8.2, this flaw poses a high risk to data confidentiality and integrity, potentially leading to significant reputational damage and regulatory non-compliance.

Immediate Action: There is no official patch provided by the vendor. Administrators should immediately discontinue the use of PilusCart 1.4.1 or isolate the application from the public internet until a vendor-supplied security update is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests to comment submission endpoints, particularly those containing SQL syntax such as RLIKE or CASE statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules configured to inspect and block malicious payloads targeting the send parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 46368.

Due to the lack of a vendor-provided fix and the availability of a public proof-of-concept, this vulnerability presents a persistent risk to any environment hosting PilusCart 1.4.1. Organizations must prioritize the migration to a secure, supported alternative or implement robust network-level isolation to prevent unauthenticated access to the affected web application.