ChestnutCMS SQL Injection Vulnerability

A SQL injection vulnerability exists in ChestnutCMS version 1.5.10. The issue arises in the admin backend, where the content parameter of the cms_content tag can be manipulated and injected into a SQL query when the template is rendered.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, log into the ChestnutCMS admin backend and navigate to Template Management. Select the template 'index.template.html' and inject a SQL payload into the content parameter of the 'cms_content' tag. After saving the template, click the preview button to render the template, which will trigger the SQL injection by executing the injected payload on the database.