A critical SQL injection vulnerability in SMM Panel 3.1 allows unauthenticated remote attackers to access sensitive information through malicious HTTP requests.

This vulnerability is a SQL injection flaw in the SMM Panel application. It is triggered by sending a crafted HTTP request with the 'action=service_detail' parameter, which is not properly sanitized, allowing an unauthenticated attacker to interact with the database.

Successful exploitation allows an attacker to gain unauthorized access to sensitive information stored within the SMM Panel database. Given the CVSS score of 9.8, the vulnerability poses a risk of total data compromise and potential service disruption, which could cause significant reputational and operational damage.

Immediate Action: Update to the latest version of SMM Panel provided by the vendor to remediate this vulnerability.

Proactive Monitoring: Monitor database query performance and audit logs for unusual patterns or errors associated with the 'service_detail' action.

Compensating Controls: Use a WAF to block requests containing suspicious SQL syntax within the 'action' or 'service_detail' parameters.

Public Exploit Available: Unknown

Organizations running SMM Panel 3.1 should prioritize applying the vendor-supplied update immediately. Given the existence of a proof-of-concept, the urgency for remediation is high to prevent potential data exfiltration and unauthorized system access.