A critical SQL injection vulnerability in the z-9527 admin application allows unauthenticated remote attackers to compromise database integrity and access unauthorized information.

This is a SQL injection vulnerability (CWE-89) affecting multiple functions within the /server/controller/user.js file. The vulnerability is exploitable by unauthenticated remote attackers who can inject malicious SQL commands through the application interface.

The ability to perform remote SQL injection poses a severe risk to the confidentiality and integrity of the backend database. A successful exploit could lead to unauthorized data exfiltration, modification of application records, or potential administrative account takeover. Given the CVSS score of 7.3, this flaw represents a high risk to business operations that rely on the security of the z-9527 admin platform.

Immediate Action: Since no official patch is available from the vendor, organizations should restrict network access to the affected administrative interface to trusted IP ranges only.

Proactive Monitoring: Review web application access logs for suspicious SQL syntax patterns, such as UNION SELECT or tautology-based queries, directed at the identified controller endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub repository.

Due to the lack of a vendor-provided patch and the availability of a public proof-of-concept, this vulnerability must be treated with high urgency. Organizations are advised to implement strict network segmentation and WAF filtering immediately to prevent unauthorized access until a formal security update is released by the vendor.