Netartmedia PHP Business Directory 4.2 includes a scalar input flaw that allows an unauthenticated attacker to inject arbitrary SQL through the Email field in loginaction.php. This flaw, identified as CWE-89, can enable the attacker to read or manipulate database data, and potentially bypass authentication by altering the login query. The consequence is a compromise of database confidentiality and integrity, and could allow further escalation or unauthorized access to the application’s privileged functions.

The vulnerability affects installations of Netartmedia PHP Business Directory version 4.2. The vendor CNA product line is listed as Phpbusinessdirectory:Netartmedia PHP Business Directory, with no additional sub‑version details provided. Any instance running this unpatched version is considered vulnerable.

The CVSS score of 8.8 reflects a high severity due to the potential for full data disclosure and authentication bypass. The EPSS score is below 1%, indicating a low probability of an immediate public exploit, but the risk remains significant. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated HTTP POST to loginaction.php with a crafted SQL payload in the Email field, and no additional conditions are required beyond network access to the application.