A critical time-based SQL injection vulnerability in Vianeos OctoPUS 5 allows unauthenticated attackers to compromise sensitive database contents.

The application is susceptible to a time-based blind SQL injection (CWE-89) within the login_user parameter during authentication. An unauthenticated attacker can supply specially crafted SQL payloads in a POST request to trigger database sleep functions, enabling the systematic extraction of data from the backend database.

Successful exploitation of this vulnerability poses a severe risk to data confidentiality, as attackers can exfiltrate sensitive user credentials or system information from the database. Given the CVSS score of 8.2, this vulnerability is classified as High severity, and it could lead to complete unauthorized access to the application's user base or deeper compromise of the underlying infrastructure.

Immediate Action: Since no official patch is currently confirmed, administrators should restrict access to the authentication interface via network-level controls or a Web Application Firewall until the vendor provides a formal update.

Proactive Monitoring: Monitor server logs for unusually long response times or repetitive, abnormal POST requests to the authentication endpoint, which may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall with rules configured to inspect POST parameters for SQL syntax and block requests containing common injection patterns like SLEEP or UNION SELECT.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented by the Exploit-DB entry 50078.

The presence of a functional proof-of-concept and the unauthenticated nature of this attack necessitate immediate action to secure the affected infrastructure. Organizations should prioritize implementing WAF filtering or restricting public access to the vulnerable endpoint while awaiting further guidance or a definitive security patch from Vianeos.