An unauthenticated SQL injection vulnerability in the Tipray Data Leakage Prevention System exposes sensitive database information to remote attackers.

This vulnerability is a SQL injection flaw located in the findTenantPage function within the InvokerController class. An unauthenticated attacker can trigger this by sending a crafted HTTP POST request to the findTenantPage.do endpoint, specifically manipulating the sort parameter to inject malicious SQL commands.

The ability for an unauthenticated attacker to inject arbitrary SQL queries poses a severe risk to the confidentiality and integrity of the entire database. Successful exploitation could lead to unauthorized data exfiltration, modification of system records, or potential administrative account compromise. Given the CVSS score of 7.3, this flaw represents a significant risk that could result in total compromise of the data managed by the system.

Immediate Action: As there is no vendor patch currently available, administrators should restrict network access to the affected management interface using firewall rules or VPNs to prevent unauthorized external access.

Proactive Monitoring: Review web access logs for anomalous POST requests directed at the findTenantPage.do endpoint, specifically looking for payloads containing SQL keywords like SLEEP, UNION, or SELECT.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns within POST parameters to provide a virtual patch until an official update is released.

Public Exploit Available: Yes, a proof-of-concept is documented in a publicly available researcher write-up on GitHub.

The presence of a publicly available proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Because the vendor has not provided a patch, isolating the affected system from the public internet is the most effective method to mitigate the risk of exploitation. Security teams should prioritize this system for rigorous monitoring and apply vendor security updates immediately once they become available.