A critical SQL injection vulnerability in Tipray Data Leakage Prevention System 1.0 allows unauthenticated remote attackers to compromise the backend database.

The application fails to properly sanitize the sort parameter within the findFileServerPage function of the findFileServerPage.do interface. This flaw, which is reachable by unauthenticated remote attackers, allows for SQL injection through the manipulation of user-controllable input.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary SQL commands against the underlying database. This can lead to unauthorized data exfiltration, modification, or destruction of sensitive information stored within the system, potentially resulting in severe operational disruption and loss of confidentiality. Given the CVSS score of 7.3, this represents a significant risk to the integrity and availability of organizational data.

Immediate Action: As the vendor has not responded to disclosure, users should restrict network access to the affected interface and monitor for suspicious database queries.

Proactive Monitoring: Implement database activity monitoring to detect unusual SQL syntax or unexpected query patterns originating from the web application service account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to filter and block malicious SQL injection payloads targeting the findFileServerPage.do endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the security researcher's write-up on GitHub.

The presence of a publicly available proof-of-concept, combined with the lack of a vendor-provided patch, necessitates immediate defensive action. Administrators must treat this system as high-risk and implement strict network-level access controls to isolate the vulnerable component until a formal remediation is available from the manufacturer.