A critical hard-coded credential vulnerability in Utarit Information Services Inc SoliClub allows unauthenticated remote attackers to extract sensitive data from the system.

The application is susceptible to a hard-coded credentials flaw, classified as CWE-798, which allows an unauthenticated attacker to access sensitive constants directly. The CVSS vector of AV:N/AC:L/PR:N confirms that this attack requires no authentication and can be performed remotely over a network.

The ability for an unauthenticated actor to read sensitive constants can lead to the exposure of encryption keys, API secrets, or configuration data. Given the CVSS score of 7.5, this represents a high risk to data confidentiality, potentially facilitating further unauthorized access or lateral movement within the network. Such exposure undermines the integrity of the application environment and could lead to significant regulatory and reputational damage.

Immediate Action: Administrators must restrict network access to the affected SoliClub instances and contact the vendor to obtain the latest security update to remediate the hard-coded credentials.

Proactive Monitoring: Security teams should monitor network traffic for unauthorized access requests to configuration files or sensitive application endpoints and review system logs for anomalous authentication attempts.

Compensating Controls: Deploy a Web Application Firewall to filter traffic and block suspicious requests targeting sensitive application paths until the official patch is applied.

Public Exploit Available: No (exploit_available: false)

Due to the nature of hard-coded credentials, this vulnerability poses a severe risk to the confidentiality of sensitive system data. Organizations should prioritize updating their SoliClub installations to version 5.3.7 or higher immediately upon availability from the vendor to eliminate the exposure. Until the patch is verified and applied, implement strict network segmentation to minimize the attack surface.