A critical SQL injection vulnerability in the MailData Email Archiving System allows unauthenticated remote attackers to compromise the entire database.

This vulnerability is a SQL injection flaw that does not require authentication to trigger. It allows an attacker to manipulate database queries, potentially leading to unauthorized data access, modification, or total system takeover.

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows unauthenticated remote code or data manipulation. Successful exploitation could result in a complete breach of archived email data, loss of intellectual property, and severe reputational damage to the organization.

Immediate Action: Contact the vendor immediately to obtain a security update or patch for the Email Archiving System, as version 4.2 and earlier are confirmed vulnerable.

Proactive Monitoring: Review database and web server logs for suspicious query patterns, such as unexpected UNION operators, comment characters, or unauthorized administrative access attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious traffic directed at the archiving system until a formal patch is applied.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the referenced GitHub Gist.

Given the critical severity of this vulnerability and the availability of a public proof-of-concept, organizations must prioritize the identification and remediation of all instances of the MailData Email Archiving System. If an official patch is not immediately available, restrict network access to the affected system to trusted segments only until the software can be secured.