SQL Injection Vulnerability in Saurus CMS Community Edition
CVE-2025-52390

9.1CRITICAL

Key Information:

Vendor

Saurus CMS

Status
Saurus CMS Community Edition
Vendor
CVE Published:
1 August 2025

What is CVE-2025-52390?

Saurus CMS Community Edition versions since commit d886e5b0 are susceptible to SQL Injection through the prepareSearchQuery() method in FulltextSearch.class.php. This vulnerability arises from the direct concatenation of user-supplied input into SQL queries without proper sanitization, facilitating attackers in altering SQL logic. This may lead to unauthorized data exposure or privilege escalation, putting sensitive information at risk.

References

https://github.com/sauruscms/Saurus-CMS-Community-Edition...
https://github.com/theharshkothari/vulnerability-research...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.