A blind SQL injection vulnerability in the JoomSky JS Help Desk plugin allows authenticated attackers to potentially extract sensitive database information.

This vulnerability is a classic SQL injection (CWE-89) flaw residing within the js-support-ticket component. The CVSS vector indicates that an attacker requires low privileges (authenticated) to execute the attack, which then allows for unauthorized data access and potential impact on system availability.

The ability to perform blind SQL injection poses a significant risk to the confidentiality of stored data, as attackers can systematically query the database to exfiltrate sensitive user or configuration information. With a CVSS score of 8.5, this vulnerability is classified as High, reflecting the potential for severe information disclosure and disruption of service.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately deactivate or uninstall the JS Help Desk plugin until a security update is released by JoomSky.

Proactive Monitoring: Review database query logs for anomalous or repetitive patterns characteristic of blind SQL injection attempts, such as unusually long execution times or high volumes of requests to the ticket support module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads targeted at WordPress plugin endpoints.

Public Exploit Available: Unknown.

Given the High severity of this flaw and the potential for data exfiltration, organizations must treat this as a priority. If the plugin is essential to business operations, restrict access to the affected module to the minimum number of users possible and implement strict WAF filtering while awaiting a vendor-supplied update.