SQL injection (SQLi) in the user authentication module of Futurum Software
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in May 2026
- Public exploit
- None on Exploit-DB
Summary
Futurum Software's management software, specifically its user authentication module, is affected by a SQL injection flaw that lets an unauthenticated attacker run arbitrary database queries. Successful exploitation could expose the database structure and sensitive customer information, including personal data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms to be bypassed solely by sending manipulated HTTP requests. Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary queries against the database, extract its complete structure and gain access to sensitive customer information, including personally identifiable information (PII).
Affected versions
- Futurum Software Futurum Software User Authentication Module
fixed in May 2026