Executive brief
A security vulnerability exists in code-projects Simple Content Management System 1.0, a tool used for managing website content. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially exposing sensitive information such as user credentials and site data. This could lead to a full compromise of the website's information and unauthorized data modification.
Technical details
A SQL injection vulnerability (CWE-89) exists in code-projects Simple Content Management System 1.0 within the '/web/index.php' component. The 'id' parameter is not properly sanitized before being used in a database query, allowing an unauthenticated remote attacker to execute arbitrary SQL commands. By supplying a crafted 'id' value, such as a UNION-based payload, an attacker can extract sensitive information including database names, table structures, and user credentials. A public exploit (PoC) has been released, increasing the risk of exploitation. No official patch is currently documented.
Affected products
- code-projects Simple Content Management System 1.0
Timeline
- 2026-04-13: disclosed: Initial disclosure and CVE assignment
- 2026-04-13: advisory: NVD publication date