Nocobase v2.1.21 is vulnerable to a critical SQL injection flaw that allows unauthenticated remote attackers to compromise the integrity and confidentiality of the entire database.

The vulnerability exists within the checkSQL function, which fails to properly sanitize input. This allows an unauthenticated attacker to inject malicious SQL queries directly into the backend database.

The potential for unauthorized database access poses a severe risk to organizational data, including the exposure of sensitive user records and system configurations. Given the CVSS score of 9.8, this flaw could lead to total system compromise, resulting in significant operational downtime, regulatory non-compliance, and catastrophic reputational damage.

Immediate Action: Since a specific patch version is not currently identified, administrators should restrict network access to the Nocobase instance and monitor for anomalous SQL syntax in application logs.

Proactive Monitoring: Security teams should implement database monitoring to detect unusual query patterns or unexpected export requests originating from the Nocobase application service account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads targeting the application endpoints.

Public Exploit Available: Unknown.

This vulnerability represents an extreme risk to the environment due to the lack of required authentication for exploitation. It is imperative that organizations treat this as a high-priority incident and move to isolate the affected software until an official vendor patch is released and verified for deployment.