A critical unauthenticated SQL injection vulnerability in QueryMine sms allows remote attackers to execute arbitrary database commands, potentially leading to unauthorized data modification or deletion.

The application fails to perform authentication and authorization checks in the admin/deletecourse.php script. An unauthenticated attacker can supply a malicious payload to the id GET parameter, which is then concatenated directly into a SQL statement, resulting in a SQL injection flaw.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to manipulate the backend database. This can lead to the unauthorized deletion of records, potential data exfiltration, or complete compromise of the database integrity. Given the CVSS score of 7.3, this represents a significant risk to application availability and data confidentiality.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the admin/ directory using IP allowlisting or by implementing mandatory authentication at the web server level.

Proactive Monitoring: Monitor web server access logs for suspicious GET requests targeting admin/deletecourse.php, particularly those containing SQL syntax characters such as single quotes, semicolons, or comment sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming HTTP requests.

Public Exploit Available: Yes — a published proof-of-concept exists and is attributed to the security researcher's write-up referenced in the CVE record.

This vulnerability presents a high risk due to the ease of exploitation by unauthenticated actors. Organizations utilizing QueryMine sms must treat this as a priority and implement the suggested compensating controls immediately, as the vendor has not provided a resolution. Continuous monitoring for unauthorized access attempts is essential until the underlying code is remediated.