A critical SQL injection vulnerability in HCL Aftermarket DPC version 1.0.0 exposes the application to unauthorized database information retrieval.

The application is susceptible to SQL Injection, allowing an unauthenticated attacker to manipulate database queries. This flaw enables the unauthorized extraction of sensitive data from the backend database.

The ability for an unauthenticated user to interact directly with the database poses a significant risk of data exfiltration and potential compromise of internal business records. Given the CVSS score of 8.3, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access to proprietary or customer information.

Immediate Action: Monitor the HCL support portal for the release of an official security patch and apply it immediately upon availability.

Proactive Monitoring: Review database access logs for unusual query patterns or unexpected data volume exports that may indicate exploitation attempts.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to detect and block common SQL injection patterns targeting the Aftermarket DPC environment.

Public Exploit Available: No (exploit_available: false)

The high CVSS score highlights the severity of this exposure. Organizations running HCL Aftermarket DPC version 1.0.0 should restrict network access to the application until a vendor-supplied patch is installed to neutralize the risk of unauthenticated database exploitation.