Gumbo CMS 0.99 contains a critical SQL injection vulnerability that allows unauthenticated attackers to exfiltrate sensitive database information.

This is an SQL injection vulnerability (CWE-89) triggered when the application fails to neutralize special elements in the language parameter during a POST request to the settings endpoint. The flaw allows an unauthenticated attacker to execute arbitrary SQL queries against the underlying database.

The ability for an unauthenticated attacker to execute arbitrary SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation allows for the unauthorized extraction of database contents, including usernames, version details, and internal system configurations. With a CVSS score of 8.2, this vulnerability represents a high-severity risk that could lead to full database compromise and subsequent unauthorized access to the application.

Immediate Action: As no official patch is currently available for this legacy version of Gumbo CMS, administrators should restrict access to the settings endpoint or migrate to a supported and secure content management system.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the settings endpoint, specifically looking for SQL keywords or encoded characters in the language parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP request bodies.

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the Exploit-DB entry 45837.

Given the lack of vendor-provided security updates for Gumbo CMS 0.99, this software should be considered end-of-life and inherently insecure. Organizations still utilizing this platform must prioritize decommissioning the affected instance or isolating it behind strictly controlled network segments until migration is complete. Failure to address this flaw leaves the database exposed to trivial exploitation by any remote attacker.