A critical SQL injection vulnerability in the Tipray Data Leakage Prevention System allows unauthenticated remote attackers to compromise backend database integrity.

The application is vulnerable to SQL injection through the sort parameter within the findRolePage.do endpoint. This flaw allows an unauthenticated attacker to manipulate database queries by injecting malicious SQL commands into the application backend.

The ability to perform unauthenticated SQL injection poses a severe risk to organizational data security. Successful exploitation could lead to unauthorized access to sensitive information, modification of system configurations, or complete database compromise. With a CVSS score of 7.3, this vulnerability represents a significant threat to the confidentiality and integrity of the affected environment.

Immediate Action: As there is no official vendor patch currently available, organizations should restrict network access to the affected web interface to trusted management subnets only.

Proactive Monitoring: Review web server and application logs for anomalous POST requests to the findRolePage.do endpoint, specifically monitoring for SQL syntax patterns or time-based delay signatures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting common injection vectors.

Public Exploit Available: Yes, a published proof-of-concept exists in a security research repository as referenced in the vulnerability documentation.

Given the availability of a public proof-of-concept and the lack of vendor response, this vulnerability should be treated as a priority for internal risk management. Administrators must implement strict network-level filtering and WAF protections immediately to prevent exploitation until an official update is provided by the vendor.