A critical SQL injection vulnerability in the unsupported Mediküm Web platform allows unauthenticated attackers to fully compromise the underlying database.

The application fails to neutralize special characters in SQL queries, enabling SQL injection. This allows unauthenticated remote attackers to interact directly with the database layer.

The presence of an unauthenticated SQL injection vulnerability is catastrophic, as it permits unauthorized access to sensitive business data, potential modification of records, and full administrative control over the database. With a CVSS score of 9.8, this flaw represents the highest level of risk. The fact that the product is unsupported by the vendor exacerbates this risk, as no official security patches will be issued.

Immediate Action: Since the product is unsupported, the recommended action is to decommission the software and migrate to a secure, actively maintained alternative.

Proactive Monitoring: Audit database logs for unusual query patterns, syntax errors, or unexpected data exfiltration attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious payloads before they reach the application.

Public Exploit Available: False

Given that the vendor has declared this product unsupported, there is no path to a vendor-provided patch. Organizations currently running Mediküm Web should treat this system as compromised or highly vulnerable and prioritize immediate migration to a secure platform to mitigate the risk of data breach.