A high-severity SQL injection vulnerability in Gladinet CentreStack allows authenticated users to execute unauthorized database commands, posing a significant risk to data integrity and system security.

The application is susceptible to SQL injection (CWE-89) via the X-Glad-Filter header. An authenticated attacker with low privileges can manipulate SQL queries, leading to unauthorized data access or modification.

Successful exploitation allows an attacker to bypass standard database controls, potentially leading to the theft of sensitive enterprise data or the manipulation of application records. With a CVSS score of 8.8, this vulnerability represents a severe threat to confidentiality and integrity, requiring immediate attention to prevent unauthorized administrative access or data breaches.

Immediate Action: Upgrade all instances of CentreStack to version 17.4 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review application access logs for suspicious entries in the X-Glad-Filter header and monitor database audit logs for unusual query patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to inspect and filter malicious payloads contained within HTTP headers.

Public Exploit Available: False

The high CVSS score of 8.8 underscores the critical nature of this flaw. Organizations should prioritize patching their CentreStack deployments to version 17.4 immediately to eliminate the risk of SQL injection and protect against potential unauthorized data access.