A critical SQL injection vulnerability in cool-admin-java 8.0.0 allows unauthenticated remote attackers to gain full control over the database.

This vulnerability is a SQL injection flaw found in the order() method of CrudOption.java. It allows an unauthenticated remote attacker to execute arbitrary SQL commands, resulting in full impact to confidentiality, integrity, and availability.

The CVSS score of 9.8 indicates a critical risk to the entire application stack. Successful exploitation grants an attacker the ability to read, modify, or delete database contents, which could lead to a total compromise of the application and its underlying data.

Immediate Action: Check the vendor repository for security updates and apply the latest version once available to address the flawed method.

Proactive Monitoring: Monitor database query logs for evidence of SQL injection attempts, such as unexpected syntax or commands originating from the web application layer.

Compensating Controls: Use a Web Application Firewall with SQL injection protection enabled to inspect and block malicious payloads directed at the application.

Public Exploit Available: No (Note: While public proof-of-concept code exists, there is no confirmed weaponized exploit available.)

Due to the critical nature of this SQL injection vulnerability and the existence of a public proof-of-concept, immediate action is required. Administrators should restrict access to the affected component and prioritize updating the application as soon as a fix is released by the maintainers.