A SQL injection vulnerability in TheJshen ContentManagementSystem 1.04 allows authenticated attackers to manipulate database queries, posing a significant risk of unauthorized data access.

The application fails to properly sanitize the id GET parameter before using it in database queries, which permits an authenticated attacker to execute boolean-based, time-based, or UNION-based SQL injection attacks.

Successful exploitation of this flaw can lead to the unauthorized disclosure or modification of sensitive database contents. Because the vulnerability allows for arbitrary SQL execution, an attacker could potentially bypass access controls or compromise the integrity of the entire application backend, resulting in severe data loss or system-wide disruption. The CVSS score of 7.1 highlights the high severity of this risk.

Immediate Action: Upgrade to the latest version of the software if a security update is available, or apply the vendor-provided patch to remediate the vulnerable code.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax errors or unexpected sleep commands originating from the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block SQL injection signatures targeting the id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 47569.

Given the availability of public exploit material, the risk of exploitation is elevated. Administrators should prioritize identifying instances of TheJshen ContentManagementSystem within their environment and apply necessary patches or implement strict WAF filtering to neutralize the SQL injection vector immediately.