A remote SQL injection vulnerability in EasyCMS versions 1.0 through 1.6 allows unauthenticated attackers to potentially compromise database integrity.

The application fails to properly sanitize the _order argument within the /UserAction.class.php file, resulting in a SQL injection vulnerability. This flaw can be triggered by an unauthenticated remote attacker.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation could allow unauthorized individuals to access, modify, or delete sensitive data stored within the backend database, leading to significant information disclosure or potential application service disruption.

Immediate Action: As there is no official patch available, administrators should restrict network access to the vulnerable endpoint or disable the affected functionality if it is not business-critical.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax and database logs for unusual query patterns or unauthorized access attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the /UserAction.class.php endpoint.

Public Exploit Available: Yes, a public proof of concept is available via the linked GitHub issue (https://github.com/ueh1013/VULN/issues/15).

Given the availability of a public proof of concept and the lack of a vendor-provided patch, organizations utilizing EasyCMS 1.6 or earlier are at an elevated risk. We strongly recommend implementing strict WAF filtering and segmenting the application network to prevent external access until a security update is released by the vendor.