ImpressCMS 1.3.11 contains a time‑based blind SQL injection vulnerability in the 'bid' parameter of the admin.php script. An attacker with administrator access can send a crafted POST request that causes the database engine to execute injected SQL code, allowing the attacker to retrieve arbitrary data from the database.

All released versions of the ImpressCMS content‑management platform from 1.2.3 (RC2) through 1.4.5 are affected. Users who have not applied the latest patch or updated to a version excluding the vulnerable code are at risk.

The CVSS score of 7.1 indicates high severity, but no EPSS data is available, making the current exploitation likelihood uncertain. The vulnerability requires the attacker to be authenticated as an administrator, implying exploitation must occur through the web interface. Additionally, the time‑based blind nature of the injection means that detection may require monitoring for delayed responses. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported.