A critical SQL injection vulnerability in the Lost and Found Thing Management application allows unauthenticated remote attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the addcat.php file. An unauthenticated attacker can exploit this flaw by manipulating the cata argument to execute arbitrary SQL commands.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data stored in the underlying database, potentially resulting in data exfiltration or modification. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant operational disruption and compromise of user information.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected web application or take it offline until the vendor provides a security update.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected syntax or unauthorized access attempts originating from the addcat.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection payloads targeting the cata parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

The presence of a public proof-of-concept combined with the ease of remote, unauthenticated exploitation necessitates immediate attention. Organizations utilizing this software must prioritize isolating the application from external networks and implementing strict input validation or WAF rules to prevent SQL injection attempts until an official vendor patch is released.