A critical, unauthenticated SQL injection vulnerability in Atom CMS 2.0 allows remote attackers to compromise the database and potentially gain full control of the application.

This is an improper neutralization of special elements used in an SQL command (CWE-89) located within the administrative index page. The flaw allows an unauthenticated attacker to inject malicious SQL code through the 'id' parameter to execute time-based blind SQL injection attacks.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, which may result in the exfiltration of sensitive user data, modification of application content, or administrative account takeover. Given the CVSS score of 8.2, this flaw poses a high risk to business operations, potentially leading to significant data breaches and total loss of system integrity.

Immediate Action: As no official patch is available, administrators should restrict access to the administrative directory via network-level controls or web server authentication.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to the admin index page containing SQL syntax, such as sleep commands or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the software is updated or replaced.

Public Exploit Available: Yes, a functional exploit is available via the Exploit Database (EDB-ID: 51086).

Due to the severity of this unauthenticated SQL injection, immediate action is required to secure the environment. If the software cannot be patched or adequately protected by a WAF, it should be removed from public-facing infrastructure to prevent unauthorized database access.