An unauthenticated SQL injection vulnerability in 202CMS v10 beta poses a critical risk of unauthorized database access and potential data exfiltration.

This vulnerability is an SQL injection (CWE-89) flaw located in the log_user parameter. It allows an unauthenticated attacker to manipulate backend database queries by injecting arbitrary SQL commands through crafted HTTP POST requests.

The vulnerability carries a CVSS score of 8.2, reflecting a high severity due to the potential for significant data compromise. Successful exploitation enables an attacker to bypass authentication mechanisms, extract sensitive information from the underlying database, or potentially modify stored content. This could result in severe reputational damage, loss of confidential data, and operational disruption of the affected CMS platform.

Immediate Action: As there is no official patch available for this project, administrators should immediately restrict access to the affected application or disable the vulnerable 202CMS instance until a secure alternative is implemented.

Proactive Monitoring: Security teams should review database logs for anomalous query patterns, specifically looking for SQL syntax errors or unexpected sleep commands, which are common indicators of automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious payloads targeting the log_user and reg_user parameters.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in an Exploit-DB entry (EDB-ID 46579).

Given the high severity of this SQL injection flaw and the availability of public proof-of-concept code, urgent action is required. Because the software appears to be an unmaintained or beta project, the primary recommendation is to decommission the application. If immediate decommissioning is not feasible, implement strict WAF filtering and database access restrictions to minimize the risk of unauthorized data exposure.