An SQL injection vulnerability in ResourceSpace 8.6 allows authenticated attackers to extract sensitive database information, posing a significant risk to data confidentiality.

This is a classic SQL injection flaw located within the keywords parameter of the collection_edit.php script. The vulnerability requires the attacker to be authenticated, after which they can manipulate POST requests to execute arbitrary queries against the backend MySQL database.

Successful exploitation allows an attacker to bypass standard application controls to interact directly with the database. This can lead to the unauthorized disclosure of sensitive data, including database schemas, administrative credentials, and proprietary organizational assets. Given the CVSS score of 7.1, this represents a high-severity risk that could result in full database compromise and significant reputational damage.

Immediate Action: Upgrade to a patched version of ResourceSpace beyond 8.6, as recommended by the vendor.

Proactive Monitoring: Review database access logs for unusual query patterns, specifically those containing SQL keywords or characters associated with injection attempts directed at the collection_edit.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect POST parameters for SQL injection payloads, which can effectively block malicious requests while a permanent patch is being implemented.

Public Exploit Available: Yes, a published proof-of-concept exploit exists and is documented in the Exploit Database (EDB-ID: 46274).

The presence of a publicly available exploit for this SQL injection vulnerability necessitates prompt action. Organizations running ResourceSpace 8.6 must prioritize the vendor-supplied security update to mitigate the risk of unauthorized database access. If immediate patching is not feasible, restrict access to the affected interface or implement aggressive WAF filtering to prevent exploitation until the software can be updated.