XATABoost CMS SQL Injection Vulnerability

A union-based SQL injection vulnerability has been identified in XATABoost CMS version 1.0.0. This vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Attackers can send GET requests to 'news.php' with malicious 'id' values to extract sensitive information from the database.

Impact

Exploitation of this vulnerability allows for union-based SQL injection, where an attacker can manipulate SQL queries to extract or potentially modify database information.

Reproduction

To reproduce this vulnerability, send a GET request to 'news.php' with a crafted 'id' parameter that includes SQL injection payloads. The injection point can be exploited by manipulating the SQL query handling of the application.