An authenticated SQL injection vulnerability in OCS Inventory NG Ocsreports poses a significant risk of unauthorized database data extraction and manipulation.

This is a SQL injection vulnerability (CWE-89) occurring in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. An attacker with operator-level privileges can inject malicious SQL commands to compromise database integrity and confidentiality.

The ability to perform SQL injection allows an authenticated operator to bypass standard application logic and gain unauthorized access to underlying data. This could result in the theft of sensitive inventory information, unauthorized modification of records, or potential disruption of the OCS Inventory service, justifying its high CVSS score of 8.6.

Immediate Action: Update OCS Inventory NG to the version provided by the vendor which addresses this flaw.

Proactive Monitoring: Review database access logs for unusual query patterns or syntax errors originating from the web application service account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to inspect and filter malicious input directed at the save_query_list endpoint.

Public Exploit Available: Unknown

Given the high CVSS score and the direct nature of the SQL injection flaw, administrators should prioritize applying the vendor patch. Organizations currently using OCS Inventory NG should verify their installed version and proceed with the update to ensure the integrity of the inventory database.