Inout Article Base CMS contains a critical SQL injection vulnerability that allows unauthenticated attackers to compromise sensitive database information.

The application is susceptible to SQL injection (CWE-89) within the portalLogin.php script. Unauthenticated attackers can supply malicious XOR-based payloads through the p or u GET parameters to manipulate backend database queries.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation may lead to the unauthorized extraction of sensitive user or system data stored within the database, potentially resulting in significant reputational damage and regulatory non-compliance. With a CVSS score of 8.2, this vulnerability represents a high-severity threat that requires immediate prioritization.

Immediate Action: As no official patch is currently identified, administrators should restrict public access to the vulnerable portalLogin.php endpoint or disable the affected module if it is not business-critical.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests containing SQL syntax, such as XOR or sleep commands, directed at the portalLogin.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in URL parameters to provide a layer of virtual patching.

Public Exploit Available: Yes, a functional proof-of-concept exists via the Exploit-DB entry 46593.

Given the high CVSS score and the public availability of exploit code, this vulnerability presents a significant risk to the organization. Administrators must prioritize the implementation of compensating controls, such as WAF filtering, to mitigate the risk while awaiting further guidance or vendor updates. Failure to secure this entry point may allow unauthorized parties to gain full access to the underlying database.