202CMS SQL Injection Vulnerability

A SQL injection vulnerability has been identified in 202CMS version 10 beta. This vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'log_user' parameter. Exploitation of this vulnerability could lead to the extraction of sensitive database information or modification of database contents.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to execute arbitrary SQL commands, potentially leading to unauthorized data access or manipulation.

Reproduction

The vulnerability can be reproduced by sending a POST request to 'index.php' or 'register.php' with crafted SQL statements in the 'log_user' or 'reg_user' parameters. The injected SQL can be designed to, for example, delay the response by 25 seconds, indicating successful exploitation.