Description

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the function ChapterModel::searchChapter of the file App/Home/Controller/ChapterController.class.php of the component Query Builder. The manipulation of the argument content results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-04T01:17:22.537Z",
  "pubdate": "2026-09-04T01:17:22.537Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in light0011 CMS, specifically within the Query Builder component.\nThe flaw allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL code into the 'content' argument within the ChapterModel::searchChapter function.\nSuccessful exploitation grants attackers the ability to bypass application logic, access unauthorized sensitive data, modify database contents, or potentially achieve full database compromise.\nThe vulnerability is currently unpatched as the project maintainers have not responded to disclosure reports.\nPublic exploit code is available, increasing the risk of active exploitation by malicious actors.\nImmediate action is required to implement input validation and query parameterization to neutralize this threat.",
  "technicalDetails": "The vulnerability is located in the App/Home/Controller/ChapterController.class.php file within the ChapterModel::searchChapter function.\nThe root cause of this SQL injection is the improper handling of user-supplied input. Specifically, the 'content' argument is concatenated directly into a database query string without appropriate sanitization, escaping, or the use of prepared statements.\nWhen the application processes the 'content' parameter, it fails to distinguish between data provided by the user and the intended SQL command structure. This allows an attacker to terminate the intended query early and append arbitrary SQL syntax.\nThe attack flow begins with the adversary identifying the vulnerable endpoint associated with the ChapterModel::searchChapter function. The attacker crafts a malicious payload containing SQL operators (e.g., UNION SELECT, boolean-based, or error-based injections) and transmits this payload via the 'content' argument.\nBecause the Query Builder component lacks parameterized queries, the database engine executes the injected SQL commands with the privileges of the database user configured for the CMS. This can result in unauthorized read access to the entire database schema, including administrative credentials and user data, as well as potential write or administrative actions depending on the database user's privileges.\nThe vulnerability is remotely exploitable and does not require authentication or specific privilege levels, significantly lowering the barrier to entry for malicious actors.\nPublicly available exploit code demonstrates that the flaw is easily weaponized for data exfiltration. Given the lack of versioning and current lack of response from the project maintainers, all installations using this codebase are considered inherently vulnerable until manual remediation is performed."
}