SQL Injection Vulnerability in Saurus CMS by Saurus
CVE-2026-73670
8.6HIGH
What is CVE-2026-73670?
A SQL injection vulnerability exists in the Saurus CMS, specifically in the admin/db_data.php file. This flaw allows authenticated administrators to input unsanitized data via the 'table_name' parameter, leading to arbitrary SQL execution. Attackers might leverage this vulnerability using various injection techniques, such as time-based blind and error-based executions, to enumerate the database schema. Moreover, it could enable access to sensitive system tables like information_schema, raising the risk of credential data extraction through secondary injection points.
Affected Version(s)
Saurus CMS Community Edition 0