An unauthenticated SQL injection vulnerability in Ribccs Build Smart ERP 21.0817 poses a critical risk of database compromise and unauthorized data access.

The application is susceptible to a SQL injection vulnerability via the eidValue parameter on the login validation endpoint. An unauthenticated attacker can supply malicious input to execute stacked SQL queries, enabling unauthorized interaction with the backend database.

The ability to perform unauthenticated SQL injection allows an attacker to bypass authentication mechanisms, exfiltrate sensitive business data, or modify database records. Given the CVSS score of 8.2, this vulnerability represents a high-severity risk that could lead to significant data breaches, loss of intellectual property, and potential system-wide compromise of the ERP environment.

Immediate Action: Contact the vendor, Ribccs, to obtain and apply the official security patch for the identified version. If a patch is unavailable, restrict network access to the login validation endpoint to trusted IP addresses only.

Proactive Monitoring: Review web server and database logs for anomalous activity, specifically looking for unusual characters or SQL command syntax within the eidValue parameter. Monitor for unexpected increases in database query execution times, which may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns in HTTP POST requests. Ensure that the database service account operates with the principle of least privilege to limit the impact of a successful injection.

Public Exploit Available: Yes, a functional exploit is available via ExploitDB (EDB-ID: 50445).

Given the availability of a public exploit and the ease of access to the vulnerable endpoint, this vulnerability constitutes a high-priority threat. Security teams should prioritize patching or implementing robust WAF filtering immediately to prevent potential unauthorized database access.