The Funiture platform is vulnerable to an unauthenticated SQL injection flaw that permits full database compromise, representing a critical security risk.

This vulnerability is a SQL injection flaw located in the backend tool interfaces, specifically the /sys/tool/select.json and /sys/tool/update.json endpoints. The CVSS vector confirms that this flaw is exploitable by an unauthenticated attacker over the network without requiring user interaction.

The ability to execute arbitrary SQL commands allows an attacker to bypass authentication, exfiltrate sensitive data, modify database records, or destroy data entirely. Given the CVSS score of 9.8, this vulnerability poses a severe threat to business continuity and data integrity. Organizations relying on this software face significant risks of unauthorized access to proprietary information and potential operational downtime.

Immediate Action: Since no official patch is available, administrators should immediately restrict access to the affected /sys/tool/ endpoints using network-level controls or by disabling the impacted modules if they are not essential.

Proactive Monitoring: Review web server and application logs for suspicious HTTP requests targeting the identified JSON endpoints, specifically looking for common SQL injection patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts directed at the specified URI paths.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher's write-up referenced in the CVE record.

Due to the critical nature of this SQL injection vulnerability and the availability of public proof-of-concept code, immediate protective action is mandatory. Organizations must prioritize segmenting the affected systems and implementing WAF protections to prevent exploitation until the vendor releases a formal security update.