Futurum Software User Authentication Module
Monthly
Blind SQL injection in the Futurum Software User Authentication Module allows unauthenticated remote attackers to send crafted HTTP requests to private-area endpoints that the deployed WAF fails to filter, exposing the full database structure and sensitive customer records including PII. The root cause is user-supplied input that reaches database queries without adequate validation or sanitisation, compounded by an incorrect WAF configuration that lets the protection layer be bypassed rather than serving as a compensating control. No public exploit code has been identified at time of analysis, but the issue carries an act_now priority label and a CVSS 4.0 base score of 9.1, and the affected version range is not enumerated in the available data.
Blind SQL injection in the Futurum Software User Authentication Module allows unauthenticated remote attackers to send crafted HTTP requests to private-area endpoints that the deployed WAF fails to filter, exposing the full database structure and sensitive customer records including PII. The root cause is user-supplied input that reaches database queries without adequate validation or sanitisation, compounded by an incorrect WAF configuration that lets the protection layer be bypassed rather than serving as a compensating control. No public exploit code has been identified at time of analysis, but the issue carries an act_now priority label and a CVSS 4.0 base score of 9.1, and the affected version range is not enumerated in the available data.