light0011 CMS Multiple Injection and Auth Flaws

SQL injection in light0011 CMS exposes all deployments to unauthenticated remote database compromise through the ChapterModel::searchChapter function, where the `content` argument is passed unsanitized to the Query Builder in App/Home/Controller/ChapterController.class.php. Because the project uses no versioning, every deployed commit of this PHP CMS is affected with no vendor-patched baseline to target. A public proof-of-concept exploit is available via GitHub issue #7, and the project maintainer has not responded to disclosure, leaving no official remediation path.

Server-side request forgery in light0011 CMS allows unauthenticated remote attackers to force the server to fetch arbitrary URLs by manipulating the `source[]` parameter in the bundled UEditor `catchimage` function at `Public/ueditor/php/controller.php`. Successful exploitation enables internal network reconnaissance, access to cloud metadata services (e.g., AWS IMDSv1), and pivoting to other HTTP endpoints not exposed externally. A public exploit exists via GitHub issue #6; the maintainer has not responded to disclosure and no patch has been released.

Authorization bypass in the light0011 CMS Chapter Controller (ChapterController.class.php) exposes chapter content to unauthenticated remote attackers through insecure direct object reference (IDOR). By manipulating the `content` argument in HTTP requests, an attacker can reference chapter objects they are not permitted to access, circumventing the controller's access control entirely. A public exploit was disclosed via GitHub issue #5; the maintainer has not yet responded to the responsible disclosure report.

Cross-site scripting in light0011 CMS allows remote attackers to inject arbitrary JavaScript into chapter content pages by manipulating the `content` argument processed through PHP's `htmlspecialchars_decode()` function in the chapter template. The misuse of this function-which decodes HTML entities rather than encoding them-means user-supplied chapter content is rendered as raw HTML in victims' browsers. A public proof-of-concept is available via GitHub issue #8, and the project maintainer has not responded to the coordinated disclosure.