Executive brief
OpenRapid RapidCMS, a content management system, contains a security flaw that allows unauthorized individuals to bypass login screens. By sending a specially crafted web request with a manipulated cookie, an attacker can gain full access to the system as a registered user. This could lead to unauthorized data access, website defacement, or complete administrative takeover.
Technical details
An authentication bypass vulnerability exists in OpenRapid RapidCMS v1.3.1 within the /template/default/menu.php component. The vulnerability is caused by insufficient sanitization of the 'name' cookie parameter, which is used directly in a database query. An unauthenticated attacker can perform a SQL injection (e.g., using a UNION SELECT payload) to control the query results. By combining this injection with the application's known 'encode()' function logic, an attacker can generate a valid 'user' cookie that matches the injected 'name' value, effectively bypassing the authentication check and gaining access to the system.
Affected products
- OpenRapid RapidCMS 1.3.1
Timeline
- 2026-05-27: disclosed: Vulnerability details and PoC published by MOwORN
- 2026-05-27: advisory: CVE-2026-38930 published