A critical SQL injection vulnerability in the ZuraCast backup restore functionality could allow an unauthenticated attacker to execute arbitrary commands and escalate privileges.

The azuracast:restore command insecurely processes the db.sql file extracted from a backup archive without validation or sanitization. This allows an unauthenticated, remote attacker to perform SQL injection, which can be leveraged for privilege escalation.

This critical vulnerability allows a remote attacker to compromise the entire database, potentially leading to full system takeover. With a CVSS score of 9.8, the risk of unauthorized data access, modification, or destruction is extremely high. Business operations could be severely disrupted if the database is manipulated or if administrative access is granted to an unauthorized party.

Immediate Action: Upgrade ZuraCast instances to version 0.23.8 or newer immediately.

Proactive Monitoring: Regularly audit database access logs for unusual queries or administrative actions that deviate from established baselines.

Compensating Controls: Implement strict file validation on backup archives and restrict access to the restoration functionality to authorized personnel only.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced in the vulnerability record.

The presence of a public proof-of-concept increases the likelihood of opportunistic attacks. Administrators must prioritize the upgrade to version 0.23.8 to eliminate this injection vector. Ensure that all backup processes are secured and that any previous backups are verified for integrity.