A critical SQL injection vulnerability in Schiocco Support Board versions 3.7.7 and earlier allows authenticated attackers to gain unauthorized control over the application database.

The application is vulnerable to SQL injection via the 'calls[0][message_ids][]' parameter in the '/supportboard/include/ajax.php' endpoint. This flaw allows an authenticated attacker to perform arbitrary database operations, including retrieval, modification, and deletion of data.

The ability to execute arbitrary SQL commands poses a severe risk to data integrity and confidentiality. Attackers could potentially extract sensitive customer information, modify support tickets, or delete critical records, leading to significant operational disruption and a breach of data privacy. Given the CVSS 4.0 score of 8.8, this vulnerability is classified as high severity and requires immediate remediation to prevent unauthorized database access.

Immediate Action: Update Schiocco Support Board to version 3.7.8 or later to incorporate the vendor-supplied fix.

Proactive Monitoring: Monitor server logs for unusual HTTP requests targeting the '/supportboard/include/ajax.php' endpoint, particularly those containing unexpected special characters in the 'calls' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns directed at the affected endpoint until the software can be updated.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the security of the Support Board platform. Administrators should prioritize updating to version 3.7.8 immediately, as this is the only definitive method to eliminate the injection vector. Following the update, ensure that database access controls are reviewed to adhere to the principle of least privilege, minimizing the potential impact of any future database-related vulnerabilities.