An authenticated SQL injection vulnerability in ImpressCMS 1.3.11 allows attackers to compromise database integrity and confidentiality.

This is a time-based blind SQL injection (CWE-89) triggered by submitting malicious SQL commands through the bid parameter in POST requests to the admin.php endpoint. The attack requires the user to have valid authentication credentials to access the administrative interface.

Successful exploitation allows an attacker to manipulate backend database queries, potentially leading to the unauthorized exfiltration of sensitive information. With a CVSS score of 7.1, this vulnerability represents a significant risk to data confidentiality, as attackers can bypass standard application logic to read data directly from the underlying database.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the administrative panel to trusted IP addresses and review all user accounts for suspicious activity. If the functionality is not business-critical, disable the affected module entirely.

Proactive Monitoring: Monitor server access logs for POST requests to admin.php containing anomalous characters such as SQL keywords, quotes, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect POST parameters for SQL injection patterns and block requests containing suspicious SQL syntax.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 46239.

Given the availability of a public proof-of-concept and the potential for unauthorized data access, organizations running ImpressCMS 1.3.11 must prioritize mitigation. Immediate implementation of WAF rules and strict access controls are necessary to defend against potential exploitation until a vendor-supplied update becomes available.