ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly con…

ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality. The vulnerability exists where the login variable is directly concatenated into SQL queries without proper parameterization or sanitization. Attackers can exploit this by injecting arbitrary SQL expressions through the username field at the authentication endpoint. Successful exploitation allows attackers to create privileged accounts, read sensitive data, and potentially execute operating system commands if the database user has elevated permissions. This is a critical vulnerability as it requires no authentication and can lead to complete system compromise.