Description

Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-27T10:16:36.880Z",
  "pubdate": "2026-08-27T10:16:36.880Z",
  "executiveSummary": "This vulnerability is an unauthenticated SQL injection (SQLi) flaw affecting Epayco versions 8.4.6 and earlier.\nThe vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database management system through improper neutralization of user-supplied input.\nSuccessful exploitation compromises the confidentiality, integrity, and availability of the application's data.\nBy injecting malicious SQL payloads, an attacker can bypass authentication mechanisms, gain unauthorized access to administrative functions, exfiltrate sensitive customer or financial data, and modify or delete database records.\nThis vulnerability poses a critical risk to the security posture of any environment utilizing the affected Epayco versions, as it requires no prior authentication or administrative privileges to execute.\nAttackers can leverage this flaw via public-facing network services, necessitating immediate attention to remediation to prevent unauthorized data exposure and potential full system compromise.",
  "technicalDetails": "The vulnerability originates from a failure to correctly sanitize or parameterize user-supplied input before incorporating it into database queries within the Epayco plugin or module logic.\nBecause the input handling mechanism lacks adequate validation and employs dynamic SQL construction, an attacker can manipulate the query structure to append unauthorized commands.\nThe attack flow begins when an unauthenticated user sends a specially crafted HTTP request—typically via GET or POST parameters—containing SQL injection payloads targeting vulnerable input vectors within the Epayco codebase.\nUpon receiving the request, the application fails to distinguish between legitimate data and malicious SQL syntax, effectively passing the attacker's input directly to the database layer for execution.\nThis allows the attacker to execute arbitrary queries, such as UNION-based injections for data exfiltration or boolean-based/time-based blind injections for inferring database content.\nBy manipulating the SQL syntax, the attacker can circumvent authentication filters, extract schema information, dump table contents, or, in misconfigured environments, potentially escalate to administrative control over the underlying database server.\nThe vulnerability is present in versions 8.4.6 and lower, reflecting a systemic flaw in the handling of external requests that interact with the persistence layer.\nThe attack requires no interaction from privileged users, as the entry point is exposed to anonymous network participants, making the service globally susceptible if accessible via the internet.\nPost-exploitation, the impact can extend to the extraction of sensitive personally identifiable information (PII), transaction records, and cryptographic tokens stored in the database.\nThe lack of prepared statements or parameterized queries serves as the primary root cause, rendering the application susceptible to traditional SQL injection techniques that manipulate the query logic to return unintended results or execute out-of-band commands."
}