Aero CMS SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Aero CMS version 0.0.1, specifically in the 'author' parameter. This vulnerability allows attackers to manipulate database queries and extract sensitive information. Exploitation techniques include boolean-based, error-based, time-based, and UNION query injections, which could potentially lead to a complete database compromise.

Impact

Exploitation of this vulnerability allows for arbitrary SQL query execution, leading to unauthorized data access, data manipulation, and potential full database compromise.

Reproduction

To reproduce this vulnerability, send a GET request to the 'author' parameter with crafted SQL payloads. The injection can be verified by using payloads that exploit boolean-based blind, error-based, time-based blind, or UNION query injection techniques. Successful exploitation can be demonstrated by extracting database information or executing database commands that indicate the injection was successful.