Chyrp versions 2.5.2 and earlier contain a critical SQL injection vulnerability that allows unauthenticated remote attackers to exfiltrate sensitive data from the underlying database.

The application is susceptible to SQL injection within the Admin.php component. This flaw allows an unauthenticated remote attacker to manipulate database queries to access unauthorized sensitive information.

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality. A successful exploit could lead to the unauthorized disclosure of administrative credentials, user records, or other sensitive configuration data stored in the database. With a CVSS score of 7.5, this high severity vulnerability necessitates immediate attention to prevent potential data breaches and subsequent regulatory or reputational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the Admin.php component using network level controls or by disabling the vulnerable functionality until a security update is released by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous URL patterns or suspicious query strings targeting the Admin.php file, particularly those containing SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the application.

Public Exploit Available: Yes, a public proof of concept exists, as documented in the security researcher write up linked in the vendor references.

Given the high CVSS score and the existence of a public proof of concept, this vulnerability represents a significant risk to the integrity of the Chyrp installation. Organizations must prioritize limiting exposure by restricting network access to the administrative interface immediately. Monitor vendor security channels closely for the release of an official patch, and apply it as soon as it becomes available to remediate the underlying code defect.