The vulnerability is a union-based SQL injection in the news.php page of XATABoost CMS 1.0.0. The flaw occurs when the application blindly includes an id parameter in a SELECT statement, allowing an attacker to supply arbitrary SQL code. The attack is unauthenticated; any user can craft a malicious GET request. Successful exploitation permits enumeration of database tables and extraction of sensitive data, including user credentials and content, potentially leading to further compromise.

XATABoost CMS 1.0.0, a content management system produced by XATABoost. No other versions were identified as vulnerable.

The CVSS score of 8.8 indicates high severity, with high confidentiality and integrity impact. The vulnerability is exploitable over HTTP without authentication, so any internet-facing instance of the CMS could be targeted. EPSS score is not available, and the flaw is not listed in CISA KEV, suggesting no widespread known exploitation yet. However, given the nature of the attack vector and the lack of authentication requirements, the probability of exploitation remains substantial for exposed installations.