FoxCMS versions 1.2.5 and earlier contain a critical SQL injection vulnerability that allows unauthenticated attackers to potentially access or modify sensitive database information.

The application is vulnerable to SQL injection through the column_model parameter located in the app/admin/controller/Column.php file. This flaw is accessible to unauthenticated remote attackers.

Successful exploitation of this vulnerability permits unauthorized interaction with the underlying database, which may lead to the disclosure of sensitive application data, unauthorized modification of records, or potential service disruption. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality, integrity, and availability of the affected system.

Immediate Action: Since no official patch version is currently identified, administrators should restrict access to the affected administrative controller or disable the vulnerable component until a vendor-supplied update is available.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax characters or unexpected strings within the column_model parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the specified file path.

Public Exploit Available: No — exploit_available is unknown.

The vulnerability presents a high risk due to the lack of required authentication for exploitation. Security teams should prioritize limiting exposure of the affected endpoint via network access controls and WAF filtering while awaiting a formal security update from the vendor. Frequent monitoring for suspicious traffic remains essential until the underlying code is remediated.