A critical SQL injection vulnerability in eDirectory allows unauthenticated attackers to bypass administrative authentication and access sensitive files on the server.

The application is susceptible to union-based SQL injection via the key parameter in the login endpoint, which permits unauthenticated attackers to bypass administrative access controls. Once authenticated, attackers can exploit additional vulnerabilities in language_file.php to perform arbitrary file disclosure and read sensitive PHP files from the server.

Successful exploitation of this vulnerability results in a total compromise of administrative access to the eDirectory platform. With an unauthenticated attacker gaining full control, the business faces significant risks, including the exfiltration of proprietary data, unauthorized modification of directory content, and potential remote code execution via the disclosure of configuration files. Given the CVSS score of 8.2, this vulnerability represents a high-severity threat that requires immediate remediation to prevent unauthorized system access.

Immediate Action: Upgrade to the latest version of eDirectory provided by the vendor to receive the necessary security patches. If an immediate update is not feasible, restrict access to the /sitemgr/ login portal and administrative directories using IP allowlisting at the network perimeter.

Proactive Monitoring: Review web server and application logs for anomalous requests to /sitemgr/login.php and language_file.php, specifically monitoring for SQL syntax patterns like "UNION SELECT" or path traversal indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection attempts targeting the key parameter and directory traversal attempts against PHP file paths.

Public Exploit Available: Yes, a functional exploit is available via Exploit-DB (EDB-ID: 46423).

The presence of a public exploit combined with the ability for an unauthenticated attacker to gain administrative privileges makes this a high-priority risk. Security teams must ensure that all instances of eDirectory are updated to a patched version immediately. Failure to address this vulnerability exposes the organization to full administrative takeover and unauthorized access to backend system files.