A critical vulnerability in the Perl DBI module allows unauthenticated remote attackers to execute arbitrary code by manipulating database connection attributes.

This vulnerability, identified as CWE-470, involves the unsafe use of externally controlled input to select code. The DBD::DBM component fails to validate the dbm_type and dbm_mldbm attributes, enabling an unauthenticated attacker to force the application to load and execute arbitrary local files.

The ability for an unauthenticated attacker to achieve arbitrary code execution represents a total compromise of the affected application environment. Given the CVSS score of 9.8, this flaw poses a severe risk of data theft, unauthorized system modification, and complete service disruption. Organizations relying on DBI for database connectivity are at immediate risk of full system takeover if they process untrusted connection strings.

Immediate Action: Upgrade the DBI module to version 1.653 or later, which includes the necessary validation logic to prevent arbitrary module loading.

Proactive Monitoring: Audit application logs for unusual database connection strings or attempts to access files outside of expected directories, particularly those containing path traversal sequences.

Compensating Controls: Ensure that any application using DBI is restricted from accepting user input directly into connection strings or DSN parameters, and utilize a Web Application Firewall to block requests containing suspicious path traversal patterns.

Public Exploit Available: No (exploit_available: false)

Due to the critical nature of this vulnerability and the potential for total system compromise, immediate patching is essential. Administrators should prioritize updating the Perl DBI module to version 1.653 across all production environments to eliminate the risk of remote code execution.