Description

CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-12T20:17:55.340Z",
  "pubdate": "2026-08-12T20:17:55.340Z",
  "executiveSummary": "CamaleonCMS version 2.9.1 suffers from an authenticated SQL injection vulnerability residing in the post slug handling mechanism. This flaw enables authenticated attackers possessing post creation or editing privileges to inject arbitrary SQL syntax through crafted slug parameters. The underlying database backend evaluates these inadequately parameterized inputs, leading to severe data exposure risks.\nThe vulnerability directly impacts the confidentiality of the application, allowing malicious actors to leverage boolean- or union-style blind SQL injection techniques against the underlying SQLite database. Through these techniques, attackers can systematically extract sensitive data, including administrative credentials and critical application configuration values stored within internal database tables.\nExploitation of this vulnerability requires valid authentication credentials with specific role privileges, specifically the capability to create or edit posts within the content management system. While authentication is required, the resulting impact spans total compromise of stored sensitive data, escalating the overall risk profile of the affected installation.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate parameterization and improper sanitization of user-supplied input within the post slug parameter in CamaleonCMS version 2.9.1. When an authenticated user submits a crafted slug value during post creation or editing operations, the application improperly concatenates or embeds this input directly into the database query executed against the SQLite backend.\nThe vulnerable component handles post routing and identifier generation, specifically where the slug field is processed and queried within the data abstraction layer. Because the application fails to utilize parameterized queries or robust input validation for the slug parameter, the database engine interprets the malicious input as executable SQL commands rather than literal string data.\nThe attack flow proceeds in a step-by-step manner. First, an attacker authenticates to the CamaleonCMS platform using an account provisioned with permissions to create or modify posts. Second, the attacker initiates a post creation or update request, substituting the standard slug value with a specially crafted payload incorporating SQL syntax. Third, the application processes the request and forwards the unparameterized query containing the injected payload to the SQLite database engine.\nDuring execution, the payload leverages boolean- or union-style blind SQL injection methodologies. Union-based techniques allow the attacker to append malicious SELECT statements to the original query, directly retrieving data within application responses. Alternatively, boolean-based blind techniques infer data byte-by-byte by evaluating true/false conditions injected into the application logic, observing subtle variations in HTTP responses or application behavior.\nThe post-exploitation impact is significant. Successful exploitation grants the attacker unauthorized access to sensitive database contents. This includes high-privilege administrative credentials, session tokens, and core configuration values stored across internal application tables, potentially facilitating complete administrative takeover of the vulnerable CMS instance."
}