CVE Alert: CVE-2025-10115 – n/a – SiempreCMS

Risk verdict

High risk: remote SQL injection in SiempreCMS with a publicly disclosed exploit and PoC; no authentication required, making rapid remote access feasible.

Why this matters

Web-facing deployments of SiempreCMS are exposed to data exposure or modification if the endpoint is targeted. Although CVSS base metrics show low impact per asset, the remote, unauthenticated access enabled by this flaw lowers the barrier for attackers and can affect multiple sites sharing the CMS.

Most likely attack path

An attacker targets the name/userName parameter in user_search_ajax.php over the network, delivering crafted input to induce SQL injection. No user interaction or privileges are needed, and the attack remains within the CMS’s database context, with potential data exfiltration or tampering. The presence of a PoC indicates practical viability.

Who is most exposed

Sites running SiempreCMS 1.3.x with publicly reachable search AJAX endpoints are most at risk, especially on shared or low-security hosting where exposure to internet traffic is routine.

Detection ideas

• Web/server logs show anomalous queries against user_search_ajax.php with SQLi patterns.
• Increased or abnormal database query times linked to that endpoint.
• WAF/IDS alerts for SQL injection payloads targeting the endpoint.
• Repeated access to the endpoint from diverse IPs with suspicious parameter strings.
• Signs of data retrieval or unexpected responses from the CMS database.

Mitigation and prioritisation

• Apply the official patch or upgrade to a fixed release (1.3.7+); verify remediation across affected instances.
• If patching is not feasible, implement strict WAF rules to block SQLi attempts on the endpoint or temporarily disable the endpoint.
• Enforce prepared statements/parameterised queries and input validation; audit the user_search_ajax.php code.
• Principle of least privilege: restrict the web app’s DB account to essential operations only.
• Plan testing in staging before deployment; monitor logs post-pix for repeat attempts; update incident response playbooks accordingly.