Kentico Xperience contains a SQL injection vulnerability that permits authenticated editors to execute unauthorized database queries, posing a significant risk to data integrity.

The software suffers from an improper neutralization of special elements used in SQL commands (CWE-89) within online marketing macro method parameters. This flaw requires the attacker to have authenticated editor-level access to the system to successfully trigger the injection.

This vulnerability allows attackers with editor privileges to manipulate the backend database, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 8.8, the issue is classified as High severity, reflecting the potential for total impact on data confidentiality and integrity. If exploited, it could result in severe reputational damage and the compromise of sensitive organizational information stored within the Kentico environment.

Immediate Action: Organizations should review the Kentico devnet hotfix portal to identify and apply the necessary patches for versions 0 through 13.0.52 immediately.

Proactive Monitoring: Security teams should implement database query logging and monitor for anomalous or suspicious SQL syntax originating from the marketing macro module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to inspect and filter malicious payloads targeting macro method parameters.

Public Exploit Available: Unknown.

Given the High severity of this SQL injection vulnerability, it is imperative that administrative teams identify all instances of Kentico Xperience running versions 13.0.52 or earlier. Apply the vendor-provided hotfixes as a priority to eliminate the injection vector, and ensure that editor-level permissions are strictly audited to minimize the risk of unauthorized exploitation.