The Grav CMS database plugin contains a flaw where the PDO::tableExists method interpolates the supplied table name directly into a raw SQL query string without any sanitization, escaping, quoting, or whitelisting. This omission permits an attacker to construct a malicious table name by a consuming plugin or custom code, resulting in arbitrary SQL execution against the configured database. The vulnerability is a classic SQL injection (CWE‑89) that or deleting database contents, potentially compromising the entire application’s data integrity and confidentiality. The CVSS base score of 9.2 indicates a critical severity, while the EPSS score of <1% shows a very low probability of current exploitation, yet the impact warrants prompt action.

All installations of the Grav CMS database plugin older than version 1.2.0 are vulnerable. Users who rely on this plugin and whose consuming plugins or custom code supply table names to the DAO layer are at risk. The issue is resolved in the publicly released 1.2.0 version by the plugin author.

High risk due to the critical CVSS score of 9.2 and the complete lack of input sanitization. The EPSS score of <1% is not listed in the CISA KEV catalog. Attackers who can influence the table name parameter—such as through a malicious consuming plugin or developer code—can inject arbitrary SQL statements that run with the database user’s privileges. The exploit path requires only the ability to control the table name argument, with no additional complexity or configuration changes, making this weakness readily exploitable in vulnerable environments.