SimplePress CMS SQL Injection Vulnerability

A SQL injection vulnerability has been identified in SimplePress CMS version 1.0.7. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious payloads through the 'p' and 's' parameters. Exploitation of this vulnerability could lead to the extraction of sensitive database information, such as usernames, database names, and version details.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could be used to manipulate the database or extract sensitive information.

Reproduction

The vulnerability can be reproduced by sending a GET request to the application with crafted SQL payloads in the 'p' or 's' parameters. The application will respond with database information that can be extracted and potentially misused.