An authenticated SQL injection vulnerability in Worklenz versions 3.0.0 and earlier allows attackers to extract sensitive database information, including user password hashes.

This vulnerability resides in the pagination helper functions of the Worklenz backend, where the sort-field query parameter is not correctly sanitized before being included in PostgreSQL ORDER BY clauses. Authenticated users can exploit this flaw to inject arbitrary SQL commands, enabling blind SQL injection attacks.

A successful exploit allows an authenticated attacker to perform unauthorized data extraction from the underlying PostgreSQL database. This could lead to a complete compromise of confidentiality, including the exfiltration of sensitive organizational data and user credentials. Given the CVSS score of 8.1, this represents a high-severity threat that requires immediate prioritization.

Immediate Action: Update Worklenz to the latest version as soon as a patch is released by the vendor, as this vulnerability is an incomplete fix for a previous security issue.

Proactive Monitoring: Review application and database logs for anomalous query patterns, specifically looking for unusual characters or SQL syntax in pagination-related parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, particularly those targeting sorting or pagination parameters in HTTP GET requests.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with its status as an incomplete remediation of a prior flaw, necessitates urgent action. Organizations should restrict access to the application until a security update is applied and thoroughly audit database access logs for signs of unauthorized data retrieval.