An unauthenticated SQL injection vulnerability in Simple Content Management System PHP 1.0 allows remote attackers to bypass authentication and gain full administrative control.

This vulnerability is a SQL injection (CWE-89) flaw located in the /web/admin/login.php file. An unauthenticated attacker can manipulate the user parameter in a POST request to bypass authentication mechanisms and achieve full administrative access.

The ability for an unauthenticated attacker to bypass authentication poses a critical risk to the confidentiality, integrity, and availability of the system. Successful exploitation grants full administrative control, which may lead to unauthorized data modification, content injection, or complete system takeover. While the CVSS score is 7.3, the potential for unauthorized administrative access necessitates immediate attention to prevent compromise.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /web/admin/ directory using network-level controls or IP allowlisting to prevent public exposure.

Proactive Monitoring: Review web server access logs for suspicious POST requests to /web/admin/login.php containing SQL injection patterns, such as the use of single quotes or tautological expressions like "or 1=1".

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the user parameter on the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub repository.

Given that this vulnerability allows for complete authentication bypass and administrative takeover, it represents a significant security risk. Administrators must prioritize isolating the affected management interface from public access until a secure update is provided by the vendor.