Victor CMS SQL Injection Vulnerability in post Parameter

A SQL injection vulnerability has been identified in Victor CMS version 1.0. The issue resides in the 'post' parameter of post.php, allowing remote attackers to manipulate database queries. Exploitation involves sending crafted UNION SELECT payloads to extract database information using boolean-based, error-based, and time-based injection techniques.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to post.php with a crafted 'post' parameter that includes SQL injection payloads. The injection can be verified using boolean-based blind, error-based, or time-based blind techniques, depending on the payload used.