EUVD-2026-57445
GHSA-rvgr-q8fx-r93h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web form exploit with low complexity; PR:L reflects mandatory authenticated editor role; C:H from admin credential extraction; I:L for potential data manipulation; A:N as no availability impact is described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables.
AnalysisAI
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to extract sensitive data - including administrative credentials and configuration values - from the underlying SQLite database via crafted slug payloads. The flaw exists because the post slug field is incorporated into backend database queries without adequate parameterization, enabling boolean- and union-based blind injection techniques over a standard network-accessible web interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with post creation or editing privileges - a standard contributor, author, or editor role in a CMS context, not administrator-level access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N) characterizes this as a network-reachable, low-complexity attack requiring only low-privilege authentication, with high confidentiality impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a contributor or editor account on an unpatched CamaleonCMS 2.9.1 installation navigates to the post creation or editing form and submits a slug field containing a boolean-based blind SQL injection payload. By iterating crafted payloads and observing differential application responses, the attacker enumerates the SQLite schema and extracts administrator password hashes or plaintext credentials stored in application tables. … |
| Remediation | Patch available per vendor advisory; operators should upgrade CamaleonCMS to the fixed version published in the upstream repository at https://github.com/owen2345/camaleon-cms - the exact patched release version number is not stated in any available reference and has not been independently confirmed, so operators must review the repository's release history or changelog directly to identify the target version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running CamaleonCMS 2.9.1 and restrict post creation and editing permissions to only essential high-trust administrators; inventory current users with these permissions and disable any unnecessary accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Camaleoncms
View allStored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist a
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a m
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administ
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote cod
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag,
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read pr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today