A critical SQL injection vulnerability in Infor Storefront B2B 1.0 allows unauthenticated attackers to execute unauthorized database queries, posing a severe risk to data integrity and confidentiality.

This flaw is a SQL injection (CWE-89) located in the usr_name parameter of the login endpoint. An unauthenticated attacker can supply malicious SQL payloads to bypass authentication or extract sensitive information directly from the backend database.

Successful exploitation allows an attacker to gain unauthorized access to the application or manipulate critical business data stored within the database. Given the CVSS score of 8.2, this vulnerability represents a high risk to organizational security, potentially leading to total loss of database confidentiality and unauthorized administrative access.

Immediate Action: Contact Infor support to verify if a security patch exists for your deployment of Storefront B2B 1.0, as no public patch version is currently documented. If no update is available, consider restricting access to the login portal via network segmentation or VPN requirements.

Proactive Monitoring: Review web server and database logs for suspicious SQL syntax, such as UNION, SELECT, or OR 1=1 statements within the usr_name field. Monitor for abnormal database query performance which may indicate automated exploitation attempts using tools like SQLmap.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads targeting the login endpoint. Ensure the database user account utilized by the application follows the principle of least privilege to limit the impact of a potential compromise.

Public Exploit Available: Yes, a published proof of concept exists via Exploit-DB (EDB-ID: 48674).

The presence of a publicly available exploit for this SQL injection vulnerability necessitates urgent attention. Security teams must treat this as a high priority risk and verify their exposure by checking if version 1.0 is in use. If an upgrade is not possible, immediate implementation of WAF filtering is required to prevent potential unauthorized data access.