An unauthenticated SQL injection vulnerability in CMSsite 1.0 permits remote attackers to extract sensitive database credentials and user information.

The application fails to properly sanitize user input in the cat_id parameter within category.php, which is then concatenated directly into a database query. This allows an unauthenticated attacker to execute arbitrary SQL commands via crafted GET requests.

The ability to perform unauthorized database queries poses a severe risk to data confidentiality and integrity. An attacker can leverage this flaw to dump entire user tables, including credentials, which could lead to a full system compromise or unauthorized access to the broader environment. With a CVSS score of 8.2, this vulnerability represents a high-severity threat that requires immediate attention to prevent data exfiltration.

Immediate Action: Since no official patch is available for this legacy software, administrators should immediately restrict access to the affected category.php endpoint or disable the application entirely.

Proactive Monitoring: Review web server access logs for suspicious GET requests targeting category.php that contain SQL syntax, such as UNION, SELECT, or hex-encoded strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and filter malicious input directed at the cat_id parameter.

Public Exploit Available: Yes, a functional proof-of-concept exploit exists on ExploitDB (EDB-ID 46259).

Given the ease of exploitation and the availability of public exploit code, the risk associated with this vulnerability is significant. Organizations still utilizing CMSsite 1.0 must recognize that the software lacks active maintenance and should prioritize migrating to a supported content management system. Until a permanent solution is implemented, ensure that the application is isolated from the internet and protected by robust network-level controls.