A critical SQL injection vulnerability in Rocket Software Zena 4.4.1.26 allows unauthenticated attackers to compromise database integrity and confidentiality.

This vulnerability is a classic SQL injection flaw located in the filter parameter. The CVSS vector confirms that the vulnerability is remotely exploitable without requiring authentication or user interaction.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive data, modification of application records, or potential denial of service. With a CVSS score of 7.3, this flaw is categorized as High severity, posing a significant risk to the confidentiality and integrity of the underlying database infrastructure.

Immediate Action: Consult the vendor for security patches or configuration guidance to neutralize the filter parameter vector. Given the lack of a confirmed patch, restrict network access to the Zena interface to trusted IP addresses only.

Proactive Monitoring: Review application and database logs for anomalous query patterns, specifically looking for SQL keywords or unusual characters within the filter parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to inspect and block malicious SQL injection payloads targeting the filter parameter.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the technical write-up referenced by the CVE record.

The presence of a public proof-of-concept combined with the lack of required authentication makes this a high-priority risk. Security teams should treat this as an urgent matter and implement network-level filtering or WAF rules immediately while awaiting official vendor remediation instructions.