A high-severity SQL injection vulnerability in Daylight Studio FuelCMS 1.5.2 exposes the application to unauthorized database access and potential data manipulation.

The application is susceptible to SQL injection via the /controllers/Login.php component. This vulnerability is accessible to unauthenticated attackers over the network.

Successful exploitation of this SQL injection vulnerability could allow an attacker to bypass authentication, access sensitive data, or modify database contents. With a CVSS score of 7.7, this flaw poses a significant risk to the confidentiality and integrity of the system, potentially leading to total compromise of the underlying database.

Immediate Action: Contact Daylight Studio support or monitor official channels for the release of a security patch addressing this SQL injection flaw.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the /controllers/Login.php file, particularly those containing SQL syntax characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting login endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists per the technical write-up referenced in the CVE record.

Given the high CVSS score and the existence of a published proof-of-concept, organizations running FuelCMS 1.5.2 must treat this vulnerability with urgency. Until a vendor patch is available, administrators should apply strict WAF filtering and monitor login traffic closely to mitigate the risk of unauthorized database exploitation.