A SQL Injection flaw exists in the Admin.php component of Chyrp CMS version 2.5.2 and older. The vulnerability is a classic example of CWE‑89, allowing a remote attacker to inject malicious SQL statements that can read or exfiltrate sensitive data from the database. The impact is direct data disclosure, potentially exposing user credentials, posts, or other confidential information, without providing control over the server or writable access beyond the database layer.

Chyrp CMS (cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*) affected in all releases up to and including version 2.5.2. No specific patch version is listed, and the vendor is not identified.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests a low probability of actual exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by crafting a SQL payload to the Admin.php endpoint. Successful exploitation grants read‑only access to the underlying database, allowing information disclosure but not arbitrary code execution.