An unauthenticated SQL injection vulnerability in WorkOrder CMS 0.1.0 allows remote attackers to bypass authentication and potentially compromise the underlying database.

This is a classic SQL injection flaw (CWE-89) triggered via the userName and password POST parameters. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject malicious SQL queries to bypass login screens or execute administrative commands.

The ability for an unauthenticated user to bypass authentication and execute arbitrary SQL queries poses a critical risk to data confidentiality and integrity. An attacker could extract sensitive user information, modify application data, or potentially gain full control over the database, leading to significant system downtime and reputational damage. The CVSS score of 8.2 reflects the high impact on confidentiality and the ease of exploitability.

Immediate Action: As there is no official vendor patch available, administrators should restrict access to the application via network-level controls or disable the service until a secure version is released.

Proactive Monitoring: Review web server and database logs for suspicious patterns, such as unexpected SQL syntax, OR 1=1 strings, or high volumes of error-based SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exploit exists via the Exploit-DB entry 51038.

Given the availability of public exploit code and the critical nature of SQL injection flaws, this vulnerability presents an immediate and actionable threat. Organizations currently running WorkOrder CMS 0.1.0 must prioritize isolating the instance from the network or implementing robust WAF filtering to prevent exploitation until the vendor provides a formal security update.