An unauthenticated SQL injection vulnerability in CMSsite 1.0 allows remote attackers to compromise database integrity and confidentiality.

The application fails to sanitize user input within the post parameter of the post.php file before including it in a database query. This allows an unauthenticated attacker to execute arbitrary SQL commands, including time-based blind injection attacks.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data stored within the backend database. Given the CVSS score of 8.2, this represents a high-severity risk that could result in significant data breaches or unauthorized administrative access to the application, potentially causing severe reputational and operational damage.

Immediate Action: As no official patch is available for this legacy software, organizations should restrict access to the affected web application or migrate to a supported content management system immediately.

Proactive Monitoring: Security teams should monitor database logs for unusual query patterns, such as unexpected use of sleep functions or syntax errors that indicate SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the post parameter in GET requests.

Public Exploit Available: Yes, a published proof-of-concept exploit exists on Exploit-DB (EDB-ID: 46402).

Due to the lack of vendor-provided security updates and the public availability of exploit code, this vulnerability poses a significant risk to any environment still running CMSsite 1.0. Organizations are strongly advised to decommission this software or isolate it behind robust network-level controls to prevent unauthorized access.