Description
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or perform time-based blind SQL injection attacks.
Published: 2026-04-05
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Immediate Patch
AI Analysis

Impact

CMSsite 1.0 permits unauthenticated attackers to inject SQL code through the "post" parameter in post.php. This flaw allows an attacker to alter database queries, extract sensitive information, or conduct time‑based blind SQL injection attacks, potentially compromising the confidentiality of the underlying data.

Affected Systems

The vulnerability affects VictorAlagwu CMSsite version 1.0. Users running this edition of the CMS are at risk unless updated.

Risk and Exploitability

The flaw is assigned a CVSS score of 8.8, indicating high severity, yet its EPSS score is below 1%, suggesting a low probability of exploitation in the wild. It is not listed in CISA’s KEV catalog. The likely method of exploitation involves sending a crafted GET request to post.php with malicious "post" values, with no authentication required.

Generated by OpenCVE AI on April 9, 2026 at 20:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Acquire and install the latest safe release of CMSsite from the vendor’s official repository.
  • If an update cannot yet be installed, restrict or block access to post.php for unauthenticated users, or filter the "post" parameter to allow only safe input.
  • Consider disabling the vulnerable post functionality until a patch becomes available.
  • Monitor web traffic and logs for suspicious requests that target post.php to detect potential exploitation attempts.

Generated by OpenCVE AI on April 9, 2026 at 20:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Apr 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:victoralagwu:cmssite:1.0:*:*:*:*:*:*:*

Tue, 07 Apr 2026 07:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Victoralagwu
Victoralagwu cmssite
Vendors & Products Victoralagwu
Victoralagwu cmssite

Sun, 05 Apr 2026 20:45:00 +0000

Type Values Removed Values Added
Description CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or perform time-based blind SQL injection attacks.
Title CMSsite 1.0 SQL Injection via post Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Victoralagwu Cmssite
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-06T18:27:24.981Z

Reserved: 2026-04-05T13:25:04.066Z

Link: CVE-2019-25674

cve-icon Vulnrichment

Updated: 2026-04-06T18:27:13.480Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-05T21:16:45.280

Modified: 2026-04-09T19:36:36.360

Link: CVE-2019-25674

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:45:25Z

Weaknesses