Westboy CicadasCMS SQL Injection Vulnerability in Content Save Interface

A critical SQL injection vulnerability has been identified in Westboy CicadasCMS version 1.0. The issue arises in the '/system/cms/content/save' interface, specifically through the 'content', 'fujian', and 'laiyuan' fields. This vulnerability allows attackers to manipulate input and execute SQL commands, potentially leading to unauthorized access to sensitive database information. The vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a POST request to the '/system/cms/content/save' endpoint. Include the 'content', 'fujian', and 'laiyuan' fields in the request. The 'fujian' field can be used to inject SQL payloads that exploit the application's SQL query handling, demonstrating the injection vulnerability.