Chyrp SQL Injection Vulnerability in Admin Component

A SQL injection vulnerability has been identified in Chyrp CMS versions through 2.5.2. This vulnerability allows authenticated attackers with admin access to manipulate SQL queries via the 'prefix' POST parameter in the Admin.php component. The lack of input validation or sanitization enables the injection of arbitrary SQL, potentially leading to unauthorized data access, data manipulation, or even a denial-of-service condition.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information, manipulation or deletion of database records, and a denial-of-service condition.

Reproduction

To reproduce this vulnerability, an authenticated administrator can send a POST request to the Admin.php component with a crafted 'prefix' parameter. The injected SQL will be executed by the application, allowing the attacker to manipulate the database as intended.