A critical SQL injection vulnerability in Testa Online Test Management System 3.4.7 allows unauthenticated attackers to compromise sensitive database information.

This vulnerability is a classic SQL injection (CWE-89) located in the search functionality. An unauthenticated attacker can manipulate the 'q' parameter in search queries to execute arbitrary SQL commands against the backend database.

The ability to perform unauthorized SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to the exposure of sensitive user data, administrative credentials, or system configurations, potentially resulting in full database compromise. With a CVSS score of 8.2, this vulnerability represents a high-severity risk that requires immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Update the Testa Online Test Management System to the latest available version that addresses this vulnerability. If no patch is currently available from the vendor, restrict access to the application until a fix can be implemented.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL keywords like UNION, SELECT, or SLEEP within the 'q' search parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application search endpoints.

Public Exploit Available: Yes, a public proof-of-concept exploit is available via the Exploit-DB entry 49194.

Given the availability of public exploit code and the ease of exploitation, this vulnerability should be prioritized for remediation. Organizations currently running version 3.4.7 must treat this as a high-priority security event. Ensure that the application is updated immediately and that defensive measures, such as WAF rules, are active to mitigate potential probing or exploitation attempts.