An unauthenticated remote SQL injection vulnerability in Teracity Software Technologies E-OSB poses a critical risk of full database compromise.

This vulnerability is a classic SQL injection (CWE-89) arising from the failure to sanitize user-supplied input before processing it in database queries. Because the attack vector is network-based with no authentication required, an unauthenticated attacker can execute arbitrary SQL commands against the backend database.

The CVSS score of 9.8 reflects the high severity of this flaw, as it allows for unauthorized data exfiltration, modification, or deletion. Successful exploitation could lead to total compromise of the application data, potential lateral movement within the network, and significant regulatory or reputational damage resulting from a data breach.

Immediate Action: Update Teracity Software Technologies E-OSB to version V02.26.07.08.01 or later to remediate the underlying code vulnerability.

Proactive Monitoring: Monitor database query logs for anomalous syntax, such as unexpected use of union statements or comment characters, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to block malicious payloads targeting the application until the software update can be applied.

Public Exploit Available: No — exploit_available (false).

Given the critical nature of this SQL injection vulnerability and the lack of authentication required for exploitation, administrators should prioritize immediate patching. Ensure that the E-OSB environment is updated to the fixed version without delay to prevent unauthorized access and potential data loss.