A SQL injection vulnerability in ZIRA Group WBRM 7.0 allows authenticated attackers to perform unauthorized database operations and potentially access sensitive information.

The application is susceptible to SQL injection via the referenceLookupsByTableNameAndColumnName function. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates that an authenticated user can trigger this flaw remotely without requiring complex conditions or user interaction.

Successful exploitation of this vulnerability permits an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data exfiltration, modification, or deletion within the underlying database. With a CVSS score of 7.6, this is a high severity issue that threatens the integrity and confidentiality of business critical data stored within the WBRM platform.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the ZIRA Group security portal for official hotfixes and apply them as soon as they are released.

Proactive Monitoring: Security teams should review application and database logs for unusual query patterns, particularly those involving unexpected syntax or unauthorized access to system tables.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust SQL injection detection rules to filter malicious payloads targeting the referenceLookupsByTableNameAndColumnName endpoint.

Public Exploit Available: Yes, a published PoC exists, attributed to the security researcher's write-up referenced in the CVE record.

Given the confirmed existence of a public proof-of-concept and the high impact of SQL injection on application security, this vulnerability presents a significant risk to the organization. IT teams must prioritize the identification of WBRM 7.0 instances and apply vendor-provided updates immediately upon availability to prevent potential data compromise.