An unauthenticated SQL injection vulnerability in phpTransformer 2016.9 allows remote attackers to extract sensitive information or manipulate database queries via the idnews parameter.

This is an SQL injection vulnerability (CWE-89) located within the GeneratePDF.php script. An unauthenticated remote attacker can supply a malicious payload through the idnews GET parameter to interact directly with the backend database.

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, which may contain sensitive user information, credentials, or application data. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to full data compromise or unauthorized administrative access, significantly impacting the confidentiality and integrity of the application.

Immediate Action: As there is no official patch available for this legacy version, administrators should restrict access to the affected GeneratePDF.php script or disable the vulnerable component entirely.

Proactive Monitoring: Security teams should monitor web server logs for suspicious GET requests targeting GeneratePDF.php, specifically those containing SQL syntax or unusual characters in the idnews parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing SQL injection patterns directed at the /Programs/news/GeneratePDF.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the Exploit-DB entry 46191.

Given the lack of vendor-supplied patches and the presence of a public proof-of-concept, this software is effectively end-of-life and insecure. Organizations still utilizing phpTransformer 2016.9 should prioritize migrating to a supported and secure content management system immediately to eliminate this critical exposure.