Executive brief
Windu CMS, a content management system used for building and managing websites, is vulnerable to a blind SQL injection attack. An unauthenticated remote attacker can exploit this flaw to interact directly with the website's database. This could lead to the unauthorized extraction of sensitive information, such as user credentials or customer data, and potentially disrupt website operations.
Technical details
A Blind SQL injection vulnerability exists in Windu CMS version 4.1 due to improper neutralization of special elements used in an SQL command (CWE-89). The flaw is located in the processing of the URL path within HTTP headers. A remote, unauthenticated attacker can send specially crafted HTTP requests to inject SQL syntax, allowing them to infer data from the database through boolean-based or time-based blind techniques. Successful exploitation can lead to full data exfiltration from the underlying SQLite database. As vendor contact attempts were unsuccessful, no official patch is currently available.
Affected products
- JCD Windu CMS 4.1
Timeline
- 2026-07-20: advisory: Advisory published by CERT.PL
- 2026-07-20: disclosed: CVE-2026-57309 published