A high-severity SQL injection vulnerability in Altium AES allows unauthenticated attackers to execute arbitrary database queries, posing a significant risk of data compromise.

The software fails to properly sanitize input due to an inactive configuration that disables updated SQL parsing logic. This allows an unauthenticated remote attacker to inject and execute arbitrary SQL commands against the backend database.

This vulnerability carries a CVSS score of 8.6, reflecting the high risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive information, potential data exfiltration, or modification of database contents, which could result in severe operational disruption and reputational damage.

Immediate Action: Review the official Altium security advisory to determine the availability of a patch or configuration update and apply it immediately to address the underlying logic flaw.

Proactive Monitoring: Implement enhanced database query logging to detect anomalous patterns and monitor for unauthorized SQL syntax or unusual access attempts originating from the web application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious input strings and block exploitation attempts while awaiting a permanent software update.

Public Exploit Available: Unknown.

Given the unauthenticated nature of this vulnerability and the potential for full database compromise, this issue must be treated with high priority. Organizations using Altium AES versions 7.0.3 through 7.0.5 should verify their current configuration against vendor guidance and apply available security updates or configuration changes immediately to eliminate the attack surface.