A critical SQL injection vulnerability in Grocery Crud allows unauthenticated remote attackers to manipulate database queries and potentially compromise sensitive data.

The software fails to properly sanitize user input in the order_by parameter within the ajax_list endpoint. This flaw allows an unauthenticated attacker to inject malicious SQL commands via POST requests, resulting in potential unauthorized data extraction or database modification.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality and integrity. With a CVSS score of 8.2, this vulnerability could allow unauthorized parties to bypass application logic, exfiltrate sensitive user records, or modify database content, leading to significant reputational damage and potential regulatory non-compliance.

Immediate Action: Update Grocery Crud to version 2.0.1 or later immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review application access logs for anomalous POST requests directed at the ajax_list endpoint, particularly those containing suspicious characters or SQL syntax in the order_by parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming HTTP requests.

Public Exploit Available: Yes, a published proof-of-concept exists in the Exploit-DB (EDB-ID: 49985).

Given the availability of a public proof-of-concept and the high severity of SQL injection vulnerabilities, immediate action is required. Organizations using versions of Grocery Crud earlier than 2.0.1 must prioritize applying the vendor-provided security update to prevent potential unauthorized database access.