An unauthenticated SQL injection vulnerability in RafyMrX TOKO-ONLINE-ROTI allows attackers to compromise backend database integrity and confidentiality.

The application is susceptible to SQL injection (CWE-89) due to improper sanitization of input, allowing unauthenticated attackers to execute arbitrary SQL commands.

SQL injection is a severe risk that can result in the exfiltration of sensitive database contents, unauthorized modification of records, or complete system takeover. The 7.3 CVSS score reflects the high potential for significant business impact, including regulatory non-compliance and data breaches.

Immediate Action: Monitor vendor channels for security patches and apply them as soon as they become available.

Proactive Monitoring: Review database query logs for anomalous or unauthorized SQL statements, particularly those involving unexpected syntax or pattern matches.

Compensating Controls: Utilize a WAF to inspect incoming traffic and filter out common SQL injection payloads before they reach the application.

Public Exploit Available: No

Given the risk of data compromise, it is imperative to restrict application access and apply all available security updates. Implement robust input validation and parameterized queries as a long-term defense against similar injection attacks.