Description

A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as information_schema, and chain the disclosure with secondary injection points to extract credential data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-13T16:19:07.400Z",
  "pubdate": "2026-08-13T16:19:07.400Z",
  "executiveSummary": "An authenticated SQL injection vulnerability exists within the CMS admin/db_data.php script, specifically at line 509. The vulnerability arises due to the direct handling of unsanitized input supplied via the table_name GET or POST parameter.\nThis flaw allows authenticated administrative users to inject arbitrary SQL commands directly into a SHOW COLUMNS FROM database statement. The potential impact is severe, enabling attackers to execute table traversal, time-based blind, boolean-based blind, and error-based SQL injection techniques.\nSuccessful exploitation grants attackers the ability to comprehensively enumerate the full database schema, query critical system tables such as information_schema, and chain data disclosure vectors with secondary injection points to extract sensitive administrative credentials and underlying system data.\nThe risk implication is high for environments where administrative accounts are compromised or untrusted insiders exist, potentially leading to total database compromise. Exploitation requires authenticated administrative access and network connectivity to the administrative interface of the affected CMS.",
  "technicalDetails": "The vulnerability resides in the administrative script admin/db_data.php at line 509, where user-supplied input via the table_name parameter (received via GET or POST methods) is concatenated directly into a database query without proper sanitization, parameterization, or input validation.\nThe vulnerable component constructs a dynamic database query utilizing the flawed SHOW COLUMNS FROM statement. Because the input is treated as executable SQL rather than literal string data, it breaks the intended query logic and allows the injection of malicious SQL payloads.\nThe attack flow proceeds as follows: 1) The authenticated administrator crafts an HTTP request containing the malicious payload injected into the table_name parameter. 2) The request is routed to admin/db_data.php. 3) The application extracts the unsanitized table_name value and embeds it into the database operation at line 509. 4) The database management system executes the resulting malicious query string.\nAttackers can leverage multiple advanced injection methodologies, including error-based injection to force database error messages containing queried data, boolean-based and time-based blind injections to infer database structures and contents through conditional responses or latency delays, and table traversal to step outside the expected data scope.\nPost-exploitation impact includes the systematic enumeration of the complete database schema, unauthorized querying of system metadata via information_schema, and the chaining of data extraction techniques with secondary injection points to harvest high-value credentials.\nPrerequisites for this attack include network access to the administrative panel, valid administrative authentication credentials to reach admin/db_data.php, and the absence of robust input validation or parameterized query mechanisms in the affected codebase."
}