Magistrala versions prior to 1.0.0 contain a critical SQL injection vulnerability that allows authenticated attackers to achieve remote code execution as the database superuser.

This vulnerability is a SQL injection flaw located within the timescale-reader and postgres-reader HTTP API services. By supplying a malicious format query parameter, an authenticated attacker can bypass identifier quoting to execute arbitrary SQL commands with superuser privileges.

The impact of this vulnerability is severe, as it permits an attacker to perform cross-tenant data theft, extract system password hashes, and achieve full remote code execution on the underlying host. Given the CVSS score of 8.8, this flaw represents a significant risk to data confidentiality, integrity, and system availability, which could lead to total compromise of the application environment.

Immediate Action: Upgrade the Magistrala installation to version 1.0.0 or later to include the necessary parameterization fixes.

Proactive Monitoring: Monitor application logs for unusual query patterns or unexpected database access requests, particularly those originating from standard user accounts.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter the format parameter in HTTP requests, although this is a temporary measure and not a substitute for patching.

Public Exploit Available: No (exploit_available: false)

Due to the potential for full system compromise, this vulnerability should be treated with high urgency. Administrators must prioritize updating to version 1.0.0 immediately to remediate the SQL injection flaw and prevent unauthorized remote code execution.