Sulu CMS contains an unauthenticated SQL injection vulnerability in its QueryBuilder component that could allow unauthorized information disclosure or denial of service.

This is an SQL injection flaw (CWE-89) located in the Smart Content QueryBuilder, specifically within the src/Sulu/Component/Content/SmartContent/QueryBuilder.php file. An unauthenticated attacker can supply crafted category identifiers to trigger unintended JCR-SQL2 queries.

The ability for an unauthenticated user to infer or enumerate content, including unpublished material, poses a significant risk to data confidentiality. Furthermore, the capacity to submit malformed queries that degrade system performance introduces a denial of service risk. While the CVSS score of 6.9 reflects a medium severity, the direct exposure of the content repository necessitates prompt remediation to prevent unauthorized information access.

Immediate Action: Update the Sulu CMS installation to version 2.6.25 or 3.0.8, depending on the release line in use.

Proactive Monitoring: Monitor web server logs for anomalous query parameters, specifically looking for unexpected characters or logic within the categories query parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malicious SQL injection patterns in incoming HTTP query strings.

Public Exploit Available: No

Given that this vulnerability allows unauthenticated access to system data and potential service degradation, it should be treated with priority. Administrators must verify their current version of Sulu and apply the provided security updates immediately to eliminate this injection vector.