Mautic contains a SQL injection vulnerability in its API endpoint that allows authenticated users to execute arbitrary database commands, posing a significant risk to data integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the query construction logic for the Contact Activity timeline. An authenticated user can trigger this flaw by manipulating the sort direction parameter, which lacks necessary allowlist validation.

The exploitation of this vulnerability could lead to unauthorized data extraction, modification, or potential disruption of database services. With a CVSS score of 7.6, the vulnerability is classified as High, reflecting the serious risk of backend database compromise and the potential for lateral movement within the application environment.

Immediate Action: Upgrade your Mautic installation to version 4.4.19, 5.2.10, 6.0.8, 7.0.1, or later as specified by the vendor.

Proactive Monitoring: Review database audit logs for unusual query patterns or unexpected SQL syntax usage originating from API service accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious payloads directed at the contact activity API endpoint.

Public Exploit Available: No

Given the severity of potential SQL injection attacks, administrators should prioritize updating to the patched versions of Mautic immediately. While the vulnerability requires authentication, the potential for unauthorized database interaction necessitates a rapid response to ensure the integrity of the marketing automation platform and protected contact data.