A critical SQL injection vulnerability in Slah CMS allows unauthenticated remote attackers to access or manipulate database contents, posing a significant risk to data integrity and confidentiality.

The application fails to properly sanitize user-supplied input in the id parameter of the vereador_ver.php endpoint. This flaw allows an unauthenticated attacker to inject malicious SQL commands, which are then executed by the backend database.

The vulnerability carries a CVSS score of 8.6, reflecting its high severity due to the lack of required authentication and the potential for full data exposure. Successful exploitation could lead to unauthorized access to sensitive user data, administrative credentials, or full database compromise, resulting in significant reputational damage and potential regulatory non-compliance.

Immediate Action: Contact the vendor or monitor the official support channels for the release of a security patch addressing this SQL injection flaw. If no patch is available, restrict access to the vereador_ver.php endpoint or disable the affected module entirely.

Proactive Monitoring: Review web server and database logs for anomalous request patterns, particularly those containing SQL keywords or unexpected characters in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: No.

Given the high CVSS score and the nature of SQL injection, this vulnerability represents an urgent security risk. Organizations currently running Slah CMS version 1.5.0 or earlier should prioritize restricting external access to the vulnerable endpoint until a formal vendor patch is verified and applied.