The vulnerability is an authenticated SQL injection that allows attackers with post creation or editing rights to craft a slug value containing SQL statements. These statements are executed by the database due to inadequate parameterization, enabling extraction of sensitive data such as administrative credentials and configuration values. The weakness is classified as CWE-89 and results in significant confidentiality loss and potential for further exploitation.

CamaleonCMS version 2.9.1 is vulnerable. The vulnerability affects users who possess permissions to create or edit posts within the CMS.

The CVSS score of 7.1 indicates a high severity risk. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. Attackers must be authenticated and must have post creation or editing privileges, which are likely granted to users with editorial or admin roles. Once authenticated, they can execute boolean or union-style blind SQL injection techniques to dump database content. The exposure includes administrative credentials and configuration data, which could enable full compromise of the application and its underlying database.