An unauthenticated SQL injection vulnerability in Oinone Pamirs (up to version 7.2.0) poses a significant risk of unauthorized data access and system compromise.

The software is affected by CWE-89 (SQL Injection) and CWE-74 (Injection). These flaws allow an unauthenticated attacker to manipulate database queries or inject arbitrary commands, as the application fails to properly neutralize user-supplied input.

With a CVSS score of 7.3, this vulnerability is considered High severity due to the lack of required authentication, making it "automatable" by remote attackers. Successful exploitation could lead to full database compromise, unauthorized modification of application data, and potential lateral movement within the network.

Immediate Action: Organizations running Oinone Pamirs versions 7.0, 7.1, or 7.2.0 should immediately restrict network access to the application and seek a vendor-provided update. If no patch is available, assess the necessity of the service and consider isolating it from public-facing networks.

Proactive Monitoring: Review application logs for unexpected input characters or patterns typically associated with injection attacks, such as single quotes, semicolons, or comment indicators.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming traffic for common injection payloads, providing a temporary layer of protection until the application can be updated.

Public Exploit Available: No — no confirmed public weaponized exploit exists in the provided data.

The combination of unauthenticated access and injection vulnerabilities represents a high-priority risk. Security teams must prioritize patching or isolating affected instances to prevent exploitation. Regular vulnerability scanning should be conducted to ensure no exposed instances remain accessible to the public internet.