A critical SQL injection vulnerability in Egavilanmedia PHPCRUD 1.0 allows unauthenticated remote attackers to compromise database confidentiality.

This is an SQL injection (CWE-89) vulnerability occurring in the application's input handling. The vulnerability is exploitable by unauthenticated remote attackers (AV:N/AC:L/PR:N/UI:N), allowing for unauthorized database information disclosure.

Successful exploitation of this vulnerability could lead to significant data exfiltration, as an attacker can manipulate backend database queries. Given the CVSS score of 8.2, this represents a high-severity risk that could result in the compromise of sensitive user information and potential loss of data integrity.

Immediate Action: Since no official patch is currently listed, implement input validation and parameterized queries for all database interactions to neutralize the injection vector.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as union-based or error-based SQL injection patterns originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads before they reach the application.

Public Exploit Available: Yes — an ExploitDB entry exists (ID 49878).

Given the availability of public exploit code and the ease of exploitation, organizations using Egavilanmedia PHPCRUD must prioritize hardening the application. If the vendor does not provide a patch, consider migrating to a supported CRUD framework or restricting access to the affected instance until a secure update is applied.