ProjeQtor versions 7.0 through 12.4.3 are vulnerable to a critical unauthenticated SQL injection flaw that could lead to full system compromise.

This is an unauthenticated SQL injection vulnerability (CWE-89) located in the login function. Because the application fails to sanitize the username input before concatenating it into a database query, an unauthenticated remote attacker can inject malicious SQL payloads.

Successful exploitation allows an attacker to bypass authentication, create unauthorized administrative accounts, exfiltrate sensitive database contents, and potentially execute OS-level commands. Given the CVSS score of 9.8, this flaw poses an extreme risk to data confidentiality, integrity, and availability, effectively granting an attacker total control over the affected instance.

Immediate Action: Update ProjeQtor to version 12.4.4 or later immediately to apply the required input sanitization and parameterization fixes.

Proactive Monitoring: Review web server and database logs for suspicious authentication attempts, specifically looking for SQL syntax patterns or unexpected character sequences in login requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting authentication endpoints.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

The critical nature of this vulnerability, combined with the availability of public proof-of-concept code, necessitates immediate patching. Administrators should prioritize upgrading to version 12.4.4 across all instances to prevent potential unauthorized access and complete system takeover.