An unauthenticated SQL injection vulnerability in the Iptanus File Upload plugin poses a critical risk of database compromise and unauthorized data access.

This vulnerability is a classic SQL injection resulting from a failure to sanitize and escape input parameters before they are processed in a SQL statement. The attack vector is unauthenticated, meaning any remote user can trigger the flaw without requiring a valid login.

This vulnerability is particularly dangerous because it does not require authentication, allowing attackers to access or manipulate the underlying database remotely. With a CVSS score of 8.6, the potential for unauthorized data exfiltration is high, which could lead to severe security breaches, loss of intellectual property, and significant operational impact.

Immediate Action: Update the Iptanus File Upload plugin to version 5.1.8 or later to patch the input sanitization issue.

Proactive Monitoring: Monitor traffic for suspicious SQL keywords in request parameters and investigate any unusual database query activity.

Compensating Controls: Deploy a Web Application Firewall with strict SQL injection filtering to block malicious requests targeting this plugin.

Public Exploit Available: Yes, public proof-of-concepts exist.

Given the unauthenticated nature of this vulnerability and the availability of proof-of-concept code, this should be treated as a high-priority remediation. Update the Iptanus File Upload plugin to version 5.1.8 immediately to secure the database layer.