MajorDoMo contains an unauthenticated SQL injection flaw in the commands module that allows an attacker to inject malicious SQL code through the $_GET['parent'] parameter. The vulnerability can be exploited with time‑based blind techniques such as UNION SELECT SLEEP(), enabling an attacker to exfiltrate data. Because admin passwords are stored as unsalted MD5 hashes, successful exploitation can reveal privileged credentials and grant full access to the administration panel, potentially compromising all user data and system integrity.

The affected product is MajorDoMo, a smart‑home platform identified under the sergejey vendor. The flaw resides in the commands module, which is loadable without authentication via the /objects/?module=commands endpoint. No specific version numbers are provided, so any deployment that includes the open commands module is potentially vulnerable.

The CVSS score of 8.8 classifies this flaw as high severity, while the EPSS score of less than 1% indicates a currently low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers have a clear path: send an unauthenticated HTTP request to the commands endpoint with a crafted "parent" query string, trigger SQL injection, read the MD5 hashes, and use them to log into the admin interface. This path requires no authentication and can be performed remotely from any network where the MajorDoMo instance is reachable.