An unauthenticated SQL injection vulnerability in PMB 7.4.6 allows remote attackers to compromise the underlying database through the ajax.php endpoint.

The application fails to sanitize the id parameter within the ajax.php file when processing storage requests. This flaw permits unauthenticated attackers to inject malicious SQL commands, including time-based blind injection, to extract sensitive database information.

Successful exploitation allows an attacker to bypass security controls and gain unauthorized access to the library management database. This can lead to the exfiltration of sensitive borrower data, administrative credentials, or bibliographic records, resulting in significant privacy breaches and potential operational disruption. Given the CVSS score of 8.2, this vulnerability poses a high risk to the confidentiality and integrity of the system.

Immediate Action: Upgrade to a version beyond 7.4.6 that incorporates the vendor security patches for this SQL injection flaw. If an update is not immediately available, restrict access to the ajax.php endpoint at the network or web server level.

Proactive Monitoring: Monitor server access logs for anomalous requests containing SQL syntax, such as SLEEP commands or conditional statements, directed at the ajax.php file. Review database query logs for unusual activity or unexpected spikes in execution time.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting known vulnerable parameters.

Public Exploit Available: Yes, a proof-of-concept exploit is available via Exploit-DB (EDB-ID: 51197).

This vulnerability represents a critical risk to the integrity of the PMB installation. Organizations should prioritize patching this software immediately to prevent data exfiltration. If patching is delayed, implementing strict WAF filtering for the affected parameter is required to mitigate the risk of unauthorized database access.