Description

Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-20T12:16:35.450Z",
  "pubdate": "2026-08-20T12:16:35.450Z",
  "executiveSummary": "An unauthenticated SQL Injection vulnerability has been identified in Directory Pro versions <= 2.5.8. This critical security flaw allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL payloads into vulnerable input parameters handled by the application. Successful exploitation of this vulnerability can lead to unauthorized access to sensitive database contents, including user credentials, configuration data, and proprietary application information. In severe scenarios, attackers may achieve database compromise or leverage the SQL injection primitive to execute further attacks against the underlying database management system. The risk implications are severe, as the vulnerability requires no prior authentication or user interaction, exposing affected deployments directly to remote compromise over the network. Remediation requires updating Directory Pro to a patched version once available or implementing strict input sanitization and parameterized queries for the affected components.",
  "technicalDetails": "The vulnerability resides within the request handling and database interaction logic of the Directory Pro plugin, specifically affecting versions <= 2.5.8. The root cause of the issue stems from insufficient input validation and a failure to utilize parameterized queries or prepared statements when processing user-supplied parameters. Because the application directly concatenates or improperly sanitizes input data into dynamic SQL query strings, an unauthenticated remote attacker can supply crafted input designed to break out of the intended SQL syntax context and alter the logical structure of the query executed by the database management system.\nThe attack flow begins when an unauthenticated adversary crafts a malicious HTTP request containing SQL injection payloads targeting vulnerable parameters exposed by Directory Pro. Upon receiving the request, the vulnerable component processes the tainted input without adequate sanitization or type checking, directly incorporating the malicious payload into a database query. The database engine parses and executes the modified query, returning unintended data or executing arbitrary database commands dictated by the attacker's payload behavior.\nNetwork exposure for this vulnerability is external, as the vulnerable endpoints are accessible over the network without requiring authentication or specific privilege levels. Post-exploitation impact is extensive; depending on database user permissions, attackers can perform data exfiltration, modify or delete database records, and potentially leverage database features to interact with the underlying operating system. The lack of authentication and privilege requirements significantly lowers the barrier to exploitation, making automated scanning and mass exploitation by malicious actors highly probable for exposed instances running Directory Pro <= 2.5.8."
}