Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows remote attackers to extract sensitive database information and potentially reset administrative passwords.

The application is vulnerable to an authenticated SQL injection flaw within the sidx parameter of the comments functionality. An attacker with low-level user privileges can leverage time-based blind SQL injection techniques to extract database content, including user activation keys.

Successful exploitation allows an attacker to bypass authentication mechanisms by retrieving user activation keys, which can be used to reset administrative passwords. This compromise leads to full administrative control over the content management system, potentially resulting in unauthorized data exfiltration, site defacement, or total system takeover. The CVSS score of 7.1 underscores the high risk associated with this vulnerability, as it provides a direct path to privilege escalation within the application environment.

Immediate Action: Upgrade to a version of Navigate CMS that addresses this vulnerability, or apply the official vendor patch if available. If no patch is currently available, restrict access to the CMS administrative and comment interfaces to trusted users only.

Proactive Monitoring: Monitor server logs for unusual HTTP POST requests directed at the navigate.php endpoint, specifically looking for anomalous query parameters or unexpected time delays in server responses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, such as the use of sleep or benchmark commands, within incoming traffic.

Public Exploit Available: Yes, a functional proof-of-concept script is available via ExploitDB (EDB-ID 48545).

Given the availability of a functional exploit script and the potential for full administrative account takeover, this vulnerability poses a significant risk to the integrity of the Navigate CMS installation. Organizations must prioritize applying security updates or implementing strict access controls to prevent unauthorized exploitation of the comments module. Failure to address this flaw could lead to a complete compromise of the application and its underlying data.