Description

Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-18T15:17:06.543Z",
  "pubdate": "2026-08-18T15:17:06.543Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified in Super Store Finder versions 7.8 and prior. This security flaw permits remote, unauthenticated threat actors to manipulate database queries by injecting malicious SQL payloads into vulnerable input parameters. Successful exploitation of this vulnerability allows unauthorized adversaries to bypass authentication mechanisms, extract sensitive database contents including administrator credentials and user data, modify application data, or potentially execute arbitrary administrative commands depending on the underlying database privileges. The presence of this vulnerability exposes deployed web servers to severe data exfiltration and complete system compromise. Remediating this issue requires immediate application of vendor-supplied patches or upgrading the affected product to a secure version beyond the identified threshold. No special privileges or prior authentication are required to execute this attack, significantly lowering the barrier to entry for malicious actors scanning for vulnerable web applications.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and improper sanitization of user-supplied parameters before they are concatenated directly into SQL queries executed by the backend database management system. In Super Store Finder versions 7.8 and lower, specific application endpoints fail to employ parameterized queries, prepared statements, or robust input filtering mechanisms. Consequently, an unauthenticated attacker can supply specially crafted HTTP requests containing malicious SQL syntax to the vulnerable components.\nThe attack flow begins when an external adversary identifies the exposed product and targets the vulnerable endpoint over the network via standard HTTP or HTTPS protocols. The attacker crafts an input payload incorporating SQL directives, such as union-based operators, boolean-based logic, or time-based delay functions, designed to interfere with the original logic of the database query. When the application processes the request, it dynamically constructs the SQL string without validating the structural integrity of the input data.\nThe database parser then executes the tainted query, interpreting the attacker's payload as legitimate database commands. Depending on the injection vector, the payload behavior may extract unauthorized records from internal tables, dump entire database schemas, or manipulate application state. The post-exploitation impact includes full database compromise, potential remote code execution on the underlying database server if specific administrative privileges and configurations are present, and severe confidentiality, integrity, and availability breaches for the host environment. The vulnerability is entirely network-accessible and requires zero authentication or user interaction for successful exploitation."
}