An unauthenticated SQL injection vulnerability in YunaiV yudao-cloud allows remote attackers to perform unauthorized database queries, posing a significant risk to data confidentiality.

This is a SQL boolean blind injection vulnerability located within the Website parameter of the /admin-api/system/tenant/get-by-website API endpoint. The vulnerability is exploitable by unauthenticated remote attackers, as the endpoint lacks the necessary input sanitization to prevent malicious SQL command execution.

The vulnerability allows an attacker to interact directly with the backend database, potentially leading to the exposure of sensitive tenant information, user credentials, or system configuration data. Given the CVSS score of 7.3, this flaw presents a high risk of unauthorized data access and potential full database compromise. Successful exploitation could result in significant reputational damage and the loss of sensitive business data.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /admin-api/system/tenant/get-by-website endpoint at the network or application gateway level.

Proactive Monitoring: Review web server and application access logs for anomalous requests containing SQL syntax or characters such as single quotes, parentheses, or sleep commands directed at the /admin-api/system/tenant/get-by-website path.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, specifically targeting the identified parameter.

Public Exploit Available: Yes, a technical write-up containing proof-of-concept attack vectors is publicly available via the researcher's GitHub repository.

Due to the lack of an official patch and the public availability of proof-of-concept material, this vulnerability poses an elevated risk. Organizations utilizing YunaiV yudao-cloud must prioritize mitigating access to the affected endpoint immediately. Continuous monitoring of database logs and the implementation of robust WAF filtering are essential until the vendor provides a formal security update.