A Blind SQL injection vulnerability in TAC Information Services GOLDENHORN ONEIT allows authenticated attackers to potentially compromise the integrity and confidentiality of the backend database.

This is a Blind SQL Injection vulnerability (CWE-89) that occurs when user-supplied input is not properly sanitized before being processed in a database query. Based on the CVSS vector (PR:L), this vulnerability requires the attacker to have low-level privileges (authenticated access) to the application to trigger the flaw.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information stored within the application database. Given the high CVSS score of 8.8, this flaw poses a significant risk of data exfiltration or manipulation, which could lead to severe reputational damage and potential regulatory non-compliance for the affected organization.

Immediate Action: Update the GOLDENHORN ONEIT software to the Göbeklitepe version or later as recommended by the vendor.

Proactive Monitoring: Review database audit logs for unusual query patterns, such as unexpected syntax errors or high volumes of data retrieval requests that indicate potential injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rulesets to detect and block common SQL injection patterns targeting the application endpoints.

Public Exploit Available: No (exploit_available: false)

The high severity of this vulnerability, combined with the potential for total technical impact, necessitates immediate action. Administrators must prioritize updating the GOLDENHORN ONEIT software to the Göbeklitepe release to eliminate the underlying injection vector and secure the application database against unauthorized queries.