Executive brief
KodiCMS is a content management system used to build and manage websites. A SQL injection vulnerability in its search functionality allows attackers to manipulate search queries and access sensitive database information without requiring authentication. This could lead to exposure of website content, user data, and other database records.
Technical details
A SQL injection vulnerability exists in the Search API Endpoint component of KodiCMS, specifically in the "like" function within cms/modules/pages/classes/kodicms/model/page.php. The vulnerability is triggered by insufficient input validation on the "keyword" parameter, allowing an attacker to inject arbitrary SQL commands. The attack is remotely exploitable without authentication or user interaction required. A successful exploit enables an attacker to read, modify, or delete database records, potentially compromising all stored application data. Public exploit code is available and the vendor has not responded to disclosure attempts.
Affected products
- Kohana KodiCMS up to 13.82.135
Timeline
- 2025-12-31: disclosed
- other: Public exploit available