ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly con…

ProjeQtor versions 7.0 through 12.4.3 contain a critical unauthenticated SQL injection vulnerability in the login functionality. The vulnerability allows attackers to inject arbitrary SQL expressions through the username field at the authentication endpoint. Successful exploitation can lead to creation of privileged accounts, reading sensitive data, and executing operating system commands if the database user has elevated permissions. The vulnerability exists because the login variable is directly concatenated into SQL queries without proper parameterization or sanitization.