A critical SQL injection vulnerability in Engeman Web versions 12.0.0.2 and earlier allows unauthenticated attackers to execute arbitrary database queries, posing a severe risk to data integrity.

This is a blind SQL injection vulnerability (CWE-89) located in the LanguageCombobox cookie parameter during the password recovery page load process. The flaw is exploitable by unauthenticated remote attackers who can manipulate backend database queries to extract sensitive information or alter system data.

Successful exploitation of this vulnerability allows unauthorized access to the application database, which can lead to the exfiltration of sensitive organizational data, unauthorized modification of records, or potential denial of service. Given the CVSS score of 7.3, this represents a significant risk to confidentiality and integrity, particularly for environments where the application database contains proprietary or sensitive business information.

Immediate Action: Update the Engeman Web software to version 12.0.0.3 or later to remediate the underlying injection vulnerability.

Proactive Monitoring: Monitor web server logs for anomalous requests to the /Login/RecoveryPass endpoint, specifically looking for unusual cookie values or characters commonly used in SQL injection payloads, such as single quotes and sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and sanitize cookie parameters, specifically blocking common SQL injection patterns targeting the LanguageCombobox field.

Public Exploit Available: Yes, a public proof-of-concept repository is available on GitHub, which provides detailed instructions and custom tamper scripts for automated exploitation tools.

The presence of a public proof-of-concept, combined with the unauthenticated nature of this vulnerability, makes it a high-priority remediation target. Administrators should prioritize upgrading to version 12.0.0.3 immediately. If an immediate update is not feasible, implement strict WAF filtering to block malicious cookie inputs targeting the password recovery functionality to mitigate the risk of exploitation.