A SQL injection flaw exists in the admin/db_data.php script of Saurus CMS Community Edition, triggered by an unsanitized table_name parameter at line 509. The vulnerability lets authenticated administrators inject arbitrary SQL into a SHOW COLUMNS FROM statement, enabling table traversal, blind and error‑based enumeration of the database schema, and access to system tables such as information_schema. Attackers can chain these capabilities with secondary injection points to exfiltrate credential data. The CVSS score of 8.6 reflects the high impact of this flaw for users with admin rights.

The affected product is Saurus CMS Community Edition. No specific version information is supplied in the advisory; all deployments of the Community Edition could be vulnerable until a patch is applied.

Because the exploit requires authenticated administrator access, the attack surface is limited to systems with administrative accounts. Nonetheless, the severity remains high due to the ability to view full schema and potentially disclose sensitive data. EPSS data is unavailable, and the issue is not listed in CISA KEV, so it may not be actively exploited yet, but the risk profile warrants immediate remediation.