CMS ALAYA contains a vulnerable SQL interface that an attacker can exploit with administrative interface access to execute arbitrary SQL statements, enabling the extraction or alteration of data stored in the database. The flaw is identified as CWE-89 and directly threatens the confidentiality and integrity of the system’s information.

The vulnerability applies to KANATA Limited’s CMS ALAYA product. No specific version details are supplied, so any installation of this CMS is potentially impacted until a patch is applied.

The CVSS score of 5.1 classifies the issue as medium severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it requires authentication to the administrative interface, the attacker must first obtain legitimate admin credentials or access; once authenticated, the SQL injection can compromise the database. Overall, the risk is moderate but mitigable with proper patching and security controls.