The Ghost Hot Spot application contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries and potentially compromise system integrity.

This is a SQL injection vulnerability (CWE-89) located in the /Auth.php file within the Login component. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data access, modification, or the potential for complete database compromise. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the application environment. Organizations should treat this as a high priority, as it permits unauthenticated remote interaction with the backend database.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /Auth.php endpoint and consider disabling the affected Login functionality until a vendor update is released.

Proactive Monitoring: Monitor web server access logs for suspicious input patterns, particularly those containing SQL syntax or unusual characters directed at the /Auth.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the provided reference from the vulnerability disclosure.

Due to the lack of a vendor-supplied patch and the presence of a published proof-of-concept, the risk of exploitation is elevated. Security teams must prioritize isolating the affected component and implementing robust WAF filtering to prevent unauthorized database interactions. Continuous monitoring of the environment is essential until a formal security update is provided by the vendor.