An unauthenticated SQL injection vulnerability in Adam Retail Automation MobilMen 20T poses a critical risk of unauthorized data access and system compromise.

The application improperly neutralizes special elements within SQL commands, allowing an unauthenticated attacker to inject arbitrary SQL code. This flaw can be exploited to manipulate or exfiltrate data directly from the backend database.

With a CVSS score of 9.8, this vulnerability allows for complete database compromise. The potential impact includes the unauthorized exposure of sensitive retail data, customer information, and potential administrative takeover of the application, leading to significant operational and reputational damage.

Immediate Action: Update to the most recent version of MobilMen 20T as soon as it becomes available from the vendor.

Proactive Monitoring: Monitor database query logs for suspicious activity, such as syntax errors or unauthorized attempts to access tables outside of standard application operations.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block incoming requests containing common SQL injection patterns.

Public Exploit Available: False

Given the vendor's reported lack of responsiveness, organizations must take proactive measures to mitigate this risk. If an official patch is not provided, evaluate the necessity of the application and consider restricting external access until a secure version is deployed.