An unauthenticated remote SQL injection vulnerability in Tipray Data Leakage Prevention System 1.0 poses a significant risk of unauthorized database access and potential data compromise.

The application is vulnerable to SQL injection within the findModulePage function of the MenuController. An attacker can supply a malicious payload through the sort argument in the findModulePage.do endpoint to execute arbitrary SQL commands against the backend database.

Successful exploitation of this SQL injection vulnerability allows an attacker to manipulate database queries, potentially leading to the unauthorized disclosure, modification, or deletion of sensitive organizational data. Given the CVSS score of 7.3, this flaw is categorized as High severity, representing a significant risk to data confidentiality and integrity within the affected environment.

Immediate Action: As there is currently no official patch from the vendor, organizations should restrict network access to the affected web interface and implement strict input validation rules to filter out SQL injection patterns.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous POST requests directed at the findModulePage.do endpoint, particularly those containing SQL keywords or time-based delay functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block SQL injection attempts targeting the sort parameter.

Public Exploit Available: Yes, a proof-of-concept is documented in the technical write-up provided by the researcher on GitHub.

The presence of a publicly available proof-of-concept combined with the ease of remote execution necessitates immediate defensive action. Administrators should prioritize isolating the affected system from external networks and implement robust WAF filtering to mitigate the risk until an official vendor update is released.