A critical SQL injection vulnerability in ureport v2.2.9 allows unauthenticated attackers to gain unauthorized access to database content.

The vulnerability resides in the /ureport/datasource/previewData component, which fails to properly sanitize user input. This allows an unauthenticated attacker to inject malicious SQL statements and interact directly with the backend database.

This vulnerability is classified as critical with a CVSS score of 9.8. The ability for an unauthenticated attacker to extract sensitive information, modify data, or potentially disrupt service poses an existential risk to the confidentiality and integrity of the underlying database.

Immediate Action: Restrict network access to the ureport datasource preview component until a security update is released by the vendor.

Proactive Monitoring: Inspect database audit logs for unauthorized queries or unusual access patterns originating from the ureport application service account.

Compensating Controls: Deploy a Web Application Firewall with rules specifically configured to detect and block SQL injection patterns targeting the /ureport/datasource/previewData endpoint.

Public Exploit Available: Yes (a public proof-of-concept exists as per security research).

The presence of a public proof-of-concept combined with the critical nature of the SQL injection flaw demands immediate attention. Organizations currently running ureport v2.2.9 should isolate the application from public networks and monitor for signs of unauthorized database access until a vendor-supplied patch is deployed.