CVE-2026-73670 in CMS Community Edition
Summary
by MITRE • 08/13/2026
A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as information_schema, and chain the disclosure with secondary injection points to extract credential data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical sql injection flaw within a content management system that specifically targets the administrative database interface. The weakness exists in the admin/db_data.php file at line 509 where unsanitized user input from the table_name parameter is directly incorporated into a SHOW COLUMNS FROM sql statement without proper validation or sanitization. As a cwe-89 sql injection vulnerability, this presents an elevated risk since it operates within an authenticated administrative context, eliminating the need for initial privilege escalation. The attack vector specifically leverages GET or POST parameters, making it accessible through various HTTP request methods that administrators might use to interact with the database management interface.
The technical exploitation capabilities of this vulnerability extend beyond simple data retrieval to encompass sophisticated enumeration techniques that can fully map the underlying database schema. Attackers can employ multiple injection methodologies including time-based blind sql injection to infer database structure through timing delays, boolean-based blind injection to extract information bit by bit, and error-based injection that leverages database error messages for data extraction. These methods allow adversaries to systematically traverse database tables and extract comprehensive schema information without requiring explicit database permissions. The vulnerability particularly affects the information_schema system tables which contain metadata about database structures, providing attackers with detailed insights into table relationships, column definitions, and database organization.
The operational impact of this vulnerability is severe as it enables complete database enumeration and credential extraction capabilities that can compromise entire administrative systems. Attackers can chain this initial disclosure with secondary injection points to access sensitive data including user credentials, session information, and other administrative details stored within the database. The authenticated nature of the attack means that only an existing administrator account would be required to exploit this vulnerability, making it particularly dangerous in environments where administrative privileges are compromised or where insider threats exist. This vulnerability essentially provides attackers with a complete roadmap for database exploitation and can lead to full system compromise through credential theft and privilege escalation.
Organizations should implement immediate mitigations including input validation and parameterized queries to prevent unsanitized data from reaching sql execution points. The principle of least privilege should be enforced by ensuring that administrative functions require additional authentication layers beyond simple session validation. Regular security assessments and code reviews should specifically target sql injection vulnerabilities in database management interfaces, with automated scanning tools configured to detect similar patterns across the entire application codebase. According to mitre attack framework, this vulnerability maps to techniques involving credential access and privilege escalation through database exploitation, while cwe-89 classification emphasizes the fundamental need for proper input sanitization in all database interaction points within web applications.