Worklenz versions prior to 2.1.7 contain critical SQL injection vulnerabilities that allow authenticated attackers to manipulate backend database queries and compromise sensitive project and financial data.

This flaw involves multiple SQL injection vulnerabilities occurring in backend SQL query construction across project, task, financial, and scheduling controllers. The CVSS vector (PR:L) indicates that an attacker must possess authenticated access to the application to trigger these injections.

The ability to execute arbitrary SQL commands poses a severe risk to data integrity, confidentiality, and availability. With a CVSS score of 8.8, successful exploitation could lead to unauthorized access to sensitive financial data, project records, and potential full database compromise, which may result in significant reputational damage and regulatory non-compliance.

Immediate Action: Update the Worklenz installation to version 2.1.7 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Review application and database logs for anomalous query patterns, such as unexpected syntax characters or unusually long execution times that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules enabled to filter malicious traffic and block unauthorized query manipulation attempts until patching is complete.

Public Exploit Available: Unknown.

Given the high CVSS severity and the existence of a proof-of-concept, organizations should prioritize the update to version 2.1.7 as a critical security task. Failure to remediate this vulnerability leaves the backend database exposed to unauthorized manipulation, potentially leading to a complete breach of sensitive project and financial information.