An unauthenticated SQL injection vulnerability in Sciyon Koyuan Thermoelectricity Heat Network Management System 3.0 poses a significant risk of remote unauthorized data access and manipulation.

This is an unauthenticated SQL injection vulnerability triggered by the improper sanitization of the PGUID parameter within the /SISReport/WebReport20/Proxy/AsyncTreeProxy.aspx endpoint. Attackers can remotely inject malicious SQL commands into the backend database, potentially bypassing authentication or accessing sensitive information.

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL commands, which can lead to full unauthorized access to the application database. Given the CVSS score of 7.3, this high-severity flaw could result in the exposure of sensitive operational or customer data, potential system compromise, and significant reputational damage to organizations utilizing this management system.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict network access to the affected management interface, ensuring it is not exposed to the public internet.

Proactive Monitoring: Security teams should monitor web access logs for suspicious POST requests directed at /SISReport/WebReport20/Proxy/AsyncTreeProxy.aspx, particularly those containing SQL syntax in the PGUID parameter.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to detect and block SQL injection patterns specifically targeting the PGUID parameter in HTTP requests.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up linked in the provided references.

The presence of a functional proof-of-concept and the unauthenticated nature of this vulnerability necessitate immediate defensive action. Organizations must treat this as a high-priority risk and implement strict network segmentation or WAF filtering to prevent potential exploitation until an official security update is released by the vendor.