CVE-2010-0952 in OneCMS
Summary
by MITRE
SQL injection vulnerability in index.php in OneCMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an elite action.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/02/2026
The vulnerability identified as CVE-2010-0952 represents a critical SQL injection flaw within the OneCMS 2.5 content management system. This vulnerability specifically targets the index.php script and exploits a fundamental weakness in input validation mechanisms. The flaw becomes particularly dangerous when the PHP configuration parameter magic_quotes_gpc is disabled, removing a crucial protective layer that would normally escape special characters in GET, POST, and COOKIE data. The vulnerability is triggered through the user parameter within an elite action, indicating that attackers can manipulate this specific input field to inject malicious SQL code. This type of vulnerability falls under CWE-89 which categorizes SQL injection as a direct result of improper input handling, where untrusted data is incorporated into SQL queries without adequate sanitization.
The operational impact of this vulnerability extends far beyond simple data theft, as it provides attackers with complete control over the underlying database system. When an attacker successfully exploits this vulnerability through the user parameter, they can execute arbitrary SQL commands that may include data extraction, modification, deletion, or even privilege escalation within the database. The remote nature of this attack means that malicious actors do not require physical access to the system or local network privileges to exploit the flaw, making it particularly dangerous for web applications. This vulnerability aligns with ATT&CK technique T1190 which describes the use of SQL injection to gain access to sensitive data and potentially escalate privileges within database systems. The attack vector specifically targets the application layer where user input is processed, making it a classic example of how insufficient input validation can lead to complete system compromise.
The exploitation of this vulnerability demonstrates a fundamental flaw in the application's security architecture where user-supplied data is directly incorporated into database queries without proper sanitization or parameterization. The requirement for magic_quotes_gpc to be disabled highlights the importance of understanding PHP security configurations and their impact on application security. When this configuration is disabled, the application becomes vulnerable to SQL injection attacks because the automatic escaping of special characters is not performed. Organizations using OneCMS 2.5 or similar applications should consider implementing proper input validation techniques such as prepared statements or parameterized queries, which are recommended practices in OWASP Top Ten security guidelines. The vulnerability also underscores the importance of proper security configuration management where default security settings should be maintained unless explicitly required to be changed for specific functionality. This particular flaw represents a common pattern in legacy web applications where security measures were not properly implemented or maintained, making it a prime target for automated exploitation tools and manual attackers seeking to compromise web applications. The remediation approach should focus on implementing proper input sanitization, using parameterized queries, and ensuring that PHP security configurations are properly maintained to prevent similar vulnerabilities from being introduced into the application codebase.