A critical SQL injection vulnerability in HUMANIST Digital Human Resources allows unauthenticated attackers to gain unauthorized access to sensitive information stored in the application.

The application is susceptible to SQL injection (CWE-312/CWE-89) due to improper handling of cleartext sensitive information. This allows an unauthenticated attacker to manipulate backend database queries, potentially leading to unauthorized data exfiltration or modification.

The CVSS score of 9.8 indicates a critical risk of data loss or manipulation. Given that this is a Human Resources management system, a successful exploit could result in the compromise of highly sensitive employee personal information, leading to significant legal and reputational consequences for the organization.

Immediate Action: Contact the vendor for the 26.1 update and apply it immediately upon availability.

Proactive Monitoring: Monitor application database logs for anomalous query patterns, such as unexpected syntax or large volumes of data extraction, which may indicate an ongoing SQL injection attempt.

Compensating Controls: Use a Web Application Firewall with SQL injection protection rules enabled to filter malicious input strings before they reach the application layer.

Public Exploit Available: Unknown.

Immediate attention is required to secure the HUMANIST Digital Human Resources platform. Until the vendor-provided update is applied, ensure that the application is isolated from public-facing internet access and verify that all database connection strings follow the principle of least privilege.