CVE-2026-30995 Slah CMS SQL Injection Vulnerability and POC

CVE-2026-30995 - Slah Informática CMS SQL Injection Vulnerability Summary Vulnerability Overview Vulnerability Type: SQL Injection CVE ID: CVE-2026-30995 CVSS Score: 9.3 Critical (CVSS v4.0) / 8.6 High (CVSS v3.1) Vulnerable Location: Line 30 of file Root Cause: The application performs no type casting or filtering on the user-provided parameter and directly concatenates it into a dynamic SQL query Impact: Allows unauthorized attackers to inject malicious SQL commands, leading to database information leakage and exposure of sensitive data Affected Scope Affected Software: Slah CMS Affected Versions: All versions up to 1.5.0 Platform: PHP Developer: Jhonatan Benetti Vendor: https://www.slah.com.br/ License: Proprietary (Commercial) Remediation Status: Fixed / Publicly Disclosed Remediation Recommendations: - Implement parameterized queries or prepared statements - Perform strict type casting and filtering on user input - Avoid directly concatenating user input into SQL queries Proof-of-Concept Code (POC) 1. UNION-based SQL Injection - Column Count Enumeration 2. Database Table Enumeration via information_schema 3. User Table Enumeration 4. Administrative Credential Exfiltration via SQL Injection Automated Exploitation Tool Code Argument Description Vulnerable Code Snippet Timeline 2025-09-01: Vulnerability identified 2025-09-02: Initial contact with vendor 2025-09-02: Vendor confirmed and requested detailed information 2025-09-03: Provided technical details and mitigation measures 2026-01-05: Vendor released official patch 2026-02-10: Requested CVE ID and initiated disclosure

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-30995 Slah CMS SQL Injection Vulnerability and POC