An unauthenticated SQL injection vulnerability in super-diamond-server allows remote attackers to execute arbitrary database commands, posing a critical risk to data integrity and system availability.

The application fails to properly parameterize the module parameter within the SQL IN clause, allowing an unauthenticated attacker to inject malicious SQL statements through the web interface.

Successful exploitation allows an attacker to bypass authentication, extract sensitive data, modify database content, or potentially gain full control over the underlying server. Given the CVSS score of 9.8, this vulnerability represents a critical threat that could lead to complete system compromise and significant business disruption.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /superdiamond/preview/ endpoint via network controls until an update is released by the vendor.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected syntax characters or large data exports, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection signatures targeting the identified endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the technical write-up provided in the references.

This vulnerability is critical and requires immediate attention to prevent unauthorized data access or total system takeover. Organizations should isolate the vulnerable application from public networks and prioritize the implementation of WAF filtering to mitigate the risk until an official patch is provided by the vendor.