A critical SQL injection vulnerability in LORIS allows unauthenticated remote attackers to compromise backend data, posing a significant risk to research integrity and system security.

The application is susceptible to a SQL injection flaw (CWE-89) within the MRI feedback popup window of the imaging browser. This vulnerability allows an unauthenticated attacker to inject malicious SQL commands, enabling unauthorized access to or modification of data stored on the backend server.

The exploitation of this vulnerability can lead to the unauthorized exposure or manipulation of sensitive neuroimaging research data. Given the CVSS score of 7.5, this high-severity flaw threatens the confidentiality and integrity of the system, potentially resulting in research data corruption and regulatory non-compliance.

Immediate Action: Upgrade the LORIS installation to version 27.0.3 or 28.0.1 immediately to incorporate the provided security patches.

Proactive Monitoring: Review web server and application logs for suspicious patterns, specifically focusing on unusual SQL syntax or unexpected query parameters originating from the imaging browser module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads targeting common web application parameters.

Public Exploit Available: exploit_available (unknown)

The vulnerability represents a significant risk due to its potential for unauthenticated data manipulation. Organizations running LORIS must prioritize the upgrade to the fixed versions to eliminate this attack surface, as SQL injection flaws are frequently targeted by automated scanning tools and malicious actors.