A critical SQL injection vulnerability in XOOPS CMS 2.5.9 allows unauthenticated remote attackers to extract sensitive database information, posing a severe risk of data compromise.

This flaw is an SQL injection (CWE-89) located in the gerar_pdf.php file. An unauthenticated attacker can manipulate database queries by injecting malicious SQL code through the cid parameter.

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, which may contain sensitive user information, configuration data, or administrative credentials. With a CVSS score of 8.2, this high-severity issue could lead to complete data exfiltration and significant reputational damage to the organization.

Immediate Action: Upgrade to a patched version of XOOPS CMS that addresses this vulnerability. If no official patch is available for your specific deployment, disable the vulnerable gerar_pdf.php file or restrict access to the affected module.

Proactive Monitoring: Review web server access logs for suspicious GET requests targeting the gerar_pdf.php script, specifically looking for unusual patterns in the cid parameter. Monitor database query logs for syntax errors or anomalous commands that deviate from expected application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in incoming HTTP requests. Ensure that database service accounts operate with the principle of least privilege to limit the scope of potential data exposure.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in ExploitDB entry 46835.

This vulnerability presents a clear and present danger to the confidentiality of the XOOPS CMS database. Given the availability of public exploit code, it is imperative that administrators verify their installation version and apply necessary updates or mitigation steps immediately to prevent unauthorized data access.