A critical SQL injection vulnerability in mfish-nocode-pro v1.0.0 allows unauthenticated attackers to compromise sensitive database information and potentially achieve full system impact.

This is a SQL injection vulnerability located in the tableName parameter of the /sys/dbConnect/data endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that this flaw is exploitable by unauthenticated remote attackers without requiring user interaction.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality, integrity, and availability. With a CVSS score of 9.8, this vulnerability could lead to unauthorized data exfiltration, modification of database contents, or complete compromise of the underlying application server.

Immediate Action: Since a vendor-provided patch is currently unknown, administrators should restrict network access to the /sys/dbConnect/data endpoint or disable the affected functionality entirely.

Proactive Monitoring: Review application and database logs for anomalous queries, especially those containing SQL syntax characters, originating from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns directed at the vulnerable endpoint.

Public Exploit Available: Yes, a published PoC exists, as documented in the research writeup referenced in the CVE record.

Given the critical severity and the public availability of proof-of-concept material, immediate mitigation is required. Organizations using mfish nocode-pro v1.0.0 must isolate the affected instance from public networks until a formal security update is released by the vendor and applied.