A critical SQL injection vulnerability in IdeaCMS versions 1.8 and earlier poses a significant risk of unauthorized database interaction via remote, unauthenticated access.

This is a SQL injection vulnerability (CWE-89) located in the whereRaw function within app/common/logic/index/Coupon.php. The flaw permits an unauthenticated remote attacker to inject malicious SQL commands by manipulating the params argument.

The ability to perform remote SQL injection allows an attacker to bypass authentication, exfiltrate sensitive data, or modify database contents. With a CVSS score of 7.3, this high-severity vulnerability could lead to total compromise of the application data layer, resulting in severe reputational damage and regulatory non-compliance.

Immediate Action: Since a specific patch version is not currently available, administrators should restrict access to the affected Coupon logic or disable the vulnerable component if it is not business-critical.

Proactive Monitoring: Monitor web application logs for suspicious input patterns, particularly those containing SQL syntax or unusual characters within the params parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the CVE record (https://github.com/rassec2/dbcve/issues/17).

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Security teams should prioritize identifying instances of IdeaCMS within their environment and apply vendor-provided updates as soon as they are released. Until an update is confirmed, maintain strict network filtering and WAF protections to mitigate the risk of exploitation.