A critical SQL injection vulnerability in the RashminDungrani online-banking software allows unauthenticated remote attackers to compromise database integrity and confidentiality.

The application fails to properly sanitize the Username argument within the site/dist/auth_login.php file, which permits unauthenticated attackers to perform SQL injection attacks.

The ability for an unauthenticated attacker to inject arbitrary SQL queries poses a severe risk to the confidentiality, integrity, and availability of the banking application. Successful exploitation could lead to unauthorized access to user credentials, sensitive financial data, or total database compromise. With a CVSS score of 7.3, this flaw is categorized as High severity, necessitating immediate attention to prevent potential data breaches and regulatory non-compliance.

Immediate Action: As no official patch is available, administrators should implement strict input validation and parameterized queries for the Username field in auth_login.php to neutralize the injection vector.

Proactive Monitoring: Review web server and database logs for suspicious SQL syntax, such as UNION, SELECT, or OR 1=1 statements, originating from the authentication endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection patterns targeting login forms.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up hosted on GitHub.

Given the availability of a public proof-of-concept and the sensitivity of banking data, this vulnerability must be treated with high urgency. Organizations utilizing this software should implement the recommended WAF controls immediately and prioritize code-level remediation to sanitize user input, as the vendor has not provided a security update.