CamaleonCMS CVE-2026-73331

Exploitation requires an authenticated session with post creation or editing privileges - a standard contributor, author, or editor role in a CMS context, not administrator-level access. The attacker must be able to reach the post slug input field over the network, meaning the CMS editing interface must be accessible from the attacker's position. The SQLite backend is a deployment-specific condition confirmed by the CVE description; CamaleonCMS installations configured with a different database engine may behave differently, though CWE-89 is not engine-specific. Limiting factors are: the authentication requirement prevents unauthenticated exploitation; successful extraction via blind injection requires iterative multi-request sessions rather than a single packet; and the attacker must have knowledge of or access to the CMS editing interface URL.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N) characterizes this as a network-reachable, low-complexity attack requiring only low-privilege authentication, with high confidentiality impact on the vulnerable system. In practice, the primary real-world risk is credential theft: successfully extracting administrator credentials from the SQLite store creates a clear path to full application takeover via privilege escalation in a second step, amplifying the effective impact beyond the raw CVSS score suggests. The PR:L requirement (a valid editor or contributor account) is the sole gatekeeping factor, and such accounts are routinely provisioned in multi-author CMS deployments. No CISA KEV listing and no confirmed public exploit code reduce immediate urgency, but the low attack complexity and well-understood blind injection methodology mean this is an operational risk, not a theoretical one. The CPE wildcard on the version field is a gap: NVD has not bounded the full affected version range, so defenders cannot rely solely on the stated version (2.9.1) to scope their exposure.

An attacker with a contributor or editor account on an unpatched CamaleonCMS 2.9.1 installation navigates to the post creation or editing form and submits a slug field containing a boolean-based blind SQL injection payload. By iterating crafted payloads and observing differential application responses, the attacker enumerates the SQLite schema and extracts administrator password hashes or plaintext credentials stored in application tables. With recovered administrator credentials, the attacker authenticates to the CMS backend and achieves full administrative control of the application.