A time-based blind SQL injection vulnerability in Tarkov Data Manager versions 2.0.0 and earlier allows authenticated attackers to execute arbitrary database commands, posing a high risk to data integrity.

This vulnerability is a time-based blind SQL injection (CWE-89) located within the webhook edit and scanner API endpoints. It requires the attacker to be an authenticated user, who can then leverage the flaw to execute arbitrary SQL commands against the backend MySQL database.

The vulnerability carries a CVSS score of 7.2, reflecting a significant risk to the confidentiality, integrity, and availability of stored data. Successful exploitation could allow an attacker to dump sensitive item data, modify database records, or potentially disrupt system operations, leading to severe reputational damage and loss of operational control.

Immediate Action: Upgrade the Tarkov Data Manager installation to a version incorporating commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8 or newer.

Proactive Monitoring: Review database query logs for unusual time-based delays or patterns indicative of blind SQL injection probing, and monitor API access logs for suspicious activity originating from authenticated accounts.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) configured to detect and block common SQL injection payloads targeted at API endpoints.

Public Exploit Available: Unknown.

Given the high CVSS score and the confirmed existence of proof-of-concept material, organizations running Tarkov Data Manager must prioritize patching this vulnerability. Administrators should ensure that all internal API traffic is restricted to authorized personnel and immediately deploy the provided commit fix to eliminate the injection vector.