The vulnerability is a classic SQL injection in MegaCMS v12.0.0, affecting the id_territorio parameter of /web_comunications/cms/get_provincias. A POST request containing malicious input can be processed without proper sanitisation, allowing an unauthenticated attacker to run arbitrary SQL commands against the database. This could lead to data exfiltration, modification, or deletion, essentially compromising the confidentiality and integrity of the database. The weakness maps to CWE‑89.

This flaw impacts MegaCMS provided by CRM Sistemas de Fidelización, specifically version 12.0.0. No other versions are listed as affected, and the vendor’s CNA notes the issue for this release only.

With a CVSS score of 10, the vulnerability is considered critical. The EPSS value is not available, so the current estimate of exploit likelihood is unknown. The CVE is not included in the CISA KEV catalog. Attackers could exploit the flaw by sending a crafted POST request to the vulnerable endpoint without needing authentication. If successful, they could gain complete control over the underlying database, making this an extremely high‑risk issue for sites still running the affected version.