An unauthenticated SQL injection vulnerability in the MajorDoMo commands module poses a high risk of credential theft and unauthorized administrative access.

This is an SQL injection vulnerability (CWE-89) located in the commands_search.inc.php file, which fails to sanitize the parent parameter. The flaw is accessible without authentication via the /objects/?module=commands endpoint, allowing attackers to perform time-based blind SQL injection.

Successful exploitation allows an unauthenticated attacker to extract sensitive data from the database, including stored administrator passwords. Given the use of unsalted MD5 hashes, these credentials can be easily cracked, leading to complete compromise of the MajorDoMo administrative interface. With a CVSS score of 8.2, this vulnerability represents a significant threat to data confidentiality and system integrity.

Immediate Action: Monitor official repository updates at the provided GitHub reference and apply the patch as soon as it becomes available.

Proactive Monitoring: Review web server access logs for suspicious requests to the /objects/ endpoint, particularly those containing SQL syntax or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block incoming requests containing malicious SQL fragments targeting the commands_search.inc.php file.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced security research.

This vulnerability is highly critical due to the ease of access and the potential for full administrative account takeover. Organizations currently running MajorDoMo must restrict network access to the application interface immediately and prioritize the implementation of vendor-supplied patches once released to mitigate the risk of credential theft.