MegaCMS SQL Injection Vulnerability

A SQL injection vulnerability has been identified in MegaCMS version 12.0.0. The issue resides in the 'id_territorio' parameter of the '/web_comunications/cms/get_provincias' endpoint. This vulnerability allows an unauthenticated attacker to manipulate the 'id_territorio' parameter, which is used immediately after the registration form is submitted, to execute arbitrary SQL queries. The root cause of this vulnerability is insufficient validation and sanitization of user input, enabling the execution of malicious SQL commands via a POST request.

Impact

Exploitation of this vulnerability allows for arbitrary SQL query execution, which could lead to unauthorized data access or manipulation within the application's database.

Remediation

Users are advised to update to the latest available version of MegaCMS.