A critical SQL injection vulnerability in SiteServer SSCMS version 7.4.0 allows authenticated attackers to achieve unauthorized database access and complete system compromise.

This vulnerability is a SQL injection flaw (CWE-89) occurring because the queryString attribute in the stl:sqlContent tag lacks proper sanitization. The vulnerability requires the attacker to possess administrative privileges (PR:H) to inject malicious payloads into the dynamic endpoint.

Successful exploitation grants an attacker the ability to execute arbitrary SQL statements, leading to full database compromise, sensitive data disclosure, or unauthorized data modification. With a CVSS score of 7.2, this vulnerability poses a significant risk to the integrity and confidentiality of the CMS environment, potentially resulting in complete takeover of the application backend.

Immediate Action: Since a specific patch version is not currently identified, administrators should restrict access to the /api/stl/actions/dynamic endpoint to trusted administrative accounts only. Contact the vendor for the latest security release or apply manufacturer-provided hotfixes as they become available.

Proactive Monitoring: Review web server and application logs for suspicious POST requests directed at the /api/stl/actions/dynamic endpoint, specifically looking for SQL syntax patterns within the request body.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block inputs containing SQL keywords or suspicious characters destined for the identified dynamic API endpoint.

Public Exploit Available: Unknown.

Given the potential for complete database compromise, organizations must prioritize restricting administrative access to the affected SiteServer installation. Monitor vendor communication channels closely for an official patch release and verify that all administrative interfaces are behind robust authentication and network-level access controls.