The flaw resides in the stl:sqlContent tag of SSCMS version 7.4.0 where the queryString attribute is forwarded directly to the database without any form of sanitization or parameterization. This omission allows an attacker to craft an encrypted payload that is passed to the /api/stl/actions/dynamic endpoint and to execute arbitrary SQL statements. The outcome is the possibility of unauthorized database access, data disclosure, authentication bypass, data modification, or full database compromise, reflecting a classic SQL Injection weakness (CWE‑89).

The only product and version marked as vulnerable are Siteserver’s SSCMS 7.4.0. No other releases are listed as affected, so the risk is limited to deployments running that exact CMS version.

The CVSS score of 8.6 classifies the vulnerability as high severity. The EPSS score is not available, so the exact likelihood of exploitation remains uncertain. Because the injection occurs through the /api/stl/actions/dynamic HTTP endpoint, it is inferred that attackers can remotely exploit the flaw by submitting crafted requests. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet appeared in known exploit sets but remains potentially exploitable if the endpoint remains reachable to untrusted users.