An unauthenticated SQL injection vulnerability in the Song-Li cross_browser legacy backend enables remote attackers to exfiltrate database contents and manipulate query execution.

The application fails to sanitize the ID parameter in the /details endpoint, which is directly concatenated into a SQL SELECT statement. This flaw allows any unauthenticated remote attacker to inject malicious SQL commands into the backend database.

The vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation allows unauthorized parties to access sensitive browser fingerprint data, potentially leading to full database enumeration or data exfiltration. While the CVSS score is 7.3, the absence of authentication requirements and the nature of SQL injection make this a high-priority risk for any organization deploying the legacy flask/uniquemachine_app.py module.

Immediate Action: Cease the use of the legacy flask/uniquemachine_app.py backend immediately and migrate to the experimental non-SQL alternative or a fully parameterized implementation.

Proactive Monitoring: Review web server and database access logs for anomalous POST requests to the /details endpoint containing SQL syntax characters such as single quotes, dashes, or SQL keywords.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block incoming JSON payloads containing suspicious SQL injection patterns, though this should be considered a temporary measure until the code is remediated.

Public Exploit Available: Yes — a public proof-of-concept exists, as documented in the security researcher's technical write-up on GitHub.

Organizations must prioritize the identification and removal of the vulnerable flask/uniquemachine_app.py component from their production environments. Given the ease of exploitation and the availability of public proof-of-concept material, immediate architectural review is necessary to ensure that legacy, insecure code paths are not exposed to untrusted network segments.