CVE-2026-85379 in cms
Summary
by MITRE • 09/04/2026
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the function ChapterModel::searchChapter of the file App/Home/Controller/ChapterController.class.php of the component Query Builder. The manipulation of the argument content results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
A critical SQL injection vulnerability exists within the light0011 content management system, specifically affecting the ChapterModel::searchChapter function located in the App/Home/Controller/ChapterController.class.php file. This flaw is rooted in the improper handling of user-supplied input passed through the content argument during chapter search operations. The underlying issue stems from a failure to properly sanitize or parameterize SQL queries constructed by the Query Builder component, allowing an attacker to inject arbitrary SQL commands into the database backend. Because this function processes data directly from HTTP requests without adequate validation against injection patterns, it represents a classic instance of insecure direct object reference combined with insufficient input sanitization in dynamic query construction.
The technical nature of this vulnerability aligns closely with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. By manipulating the content parameter, a remote attacker can bypass authentication mechanisms, extract sensitive data from the database such as user credentials and proprietary content, modify or delete existing records, or potentially execute administrative operations on the underlying database server depending on the privileges assigned to the application's database account. The absence of versioning in this product complicates remediation efforts significantly, as there is no clear distinction between affected and unaffected releases. This lack of structured release management means that administrators cannot rely on standard patch notes to identify which installations are vulnerable, necessitating a manual code audit or heuristic scanning approach to determine exposure across deployed instances.
From an operational perspective, the impact of this vulnerability extends beyond simple data theft. Successful exploitation can lead to complete compromise of the web application and potentially the underlying server infrastructure if the database service runs with elevated privileges that allow file system access or operating system command execution via specific SQL dialect features such as xp_cmdshell in Microsoft SQL Server or similar capabilities in other RDBMS platforms. The fact that an exploit has already been released publicly increases the risk profile substantially, indicating that automated scanning tools and malicious actors are likely actively targeting systems running this unpatched version of light0011 CMS. Since the project maintainers have not responded to early issue reports, users must assume no official fix is forthcoming in the near term, requiring immediate defensive measures rather than waiting for a vendor patch.
Mitigation strategies should focus on defense-in-depth techniques since code-level remediation may be difficult without source modification capabilities or access to update the vulnerable component directly. Implementing a Web Application Firewall with rules specifically tuned to detect and block SQL injection payloads targeting search parameters can provide an effective layer of protection against remote exploitation attempts. Additionally, enforcing strict input validation at the application level by whitelisting allowed characters for search queries rather than relying on blacklist-based filtering is crucial. Database-level mitigations include ensuring that the database user account used by the CMS operates under the principle of least privilege, restricting permissions to only those necessary for normal operation and disabling dangerous stored procedures or functions that could be leveraged for out-of-band data exfiltration or command execution. Regular monitoring of database logs for anomalous query patterns associated with SQL injection attacks can also aid in early detection of ongoing exploitation attempts aligned with ATT&CK technique T1059, Command and Scripting Interpreter, if the attack escalates beyond simple data extraction.