A high-severity SQL injection vulnerability in GL-iNet GL-AR300M16 firmware version 4.3.11 could allow an authenticated attacker to execute arbitrary database commands, leading to full system compromise.

This vulnerability is a SQL injection flaw located within the add_group function. It allows an authenticated user with low privileges to manipulate backend database queries via a crafted HTTP request.

Successful exploitation of this SQL injection vulnerability grants an attacker the ability to read, modify, or delete sensitive data within the device database. Given the CVSS score of 8.8, the impact is considered High, as it can lead to full administrative control over the affected network appliance, potentially facilitating lateral movement or full device takeover.

Immediate Action: Users should restrict access to the web management interface to trusted administrative networks and monitor for official firmware updates from the vendor that address the add_group function flaw.

Proactive Monitoring: Security teams should monitor device logs for unusual HTTP requests targeting the management interface, specifically looking for SQL syntax patterns or unexpected input in parameters associated with group management.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block malicious SQL injection payloads directed at the device management interface.

Public Exploit Available: Yes, a proof-of-concept exists as detailed in the technical write-up provided by the researcher on GitHub.

The severity of this vulnerability necessitates immediate attention to prevent unauthorized database access. While a vendor patch is currently pending or unverified, administrators must enforce strict access controls on the device management interface and utilize network-level filtering to mitigate the risk of exploitation.