PT-2025-31648 · Unknown · Saurus Cms Community Edition

Cyberhrsh + 1 · Published 2025-08-01 · Updated 2025-08-01 · CVE-2025-52390

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Saurus CMS Community Edition versions since commit d886e5b0 (2010-04-23)

Description Saurus CMS Community Edition is susceptible to a SQL Injection issue due to the direct concatenation of user-supplied input ($search word) into SQL queries within the prepareSearchQuery() method in FulltextSearch.class.php without proper sanitization. This allows attackers to manipulate SQL logic, potentially leading to sensitive information disclosure or privilege escalation.

Recommendations Versions since commit d886e5b0 (2010-04-23): Sanitize user input ($search word) before using it in SQL queries within the prepareSearchQuery() method in FulltextSearch.class.php.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-52390

Affected Products

Saurus Cms Community Edition

References · 5

• 🔥 https://github.com/theharshkothari/vulnerability-research/blob/main/CVE-2025-52390.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-52390 · Security Note
• https://github.com/sauruscms/Saurus-CMS-Community-Edition/blob/d886e5b0c1e2b42cd74e2184e7c81c720cd9de6b/classes/FulltextSearch.class.php#L331 · Note
• https://t.me/CVEtracker/28953 · Telegram Post
• https://twitter.com/CVEnew/status/1951325419820429797 · Twitter Post