Listen to this Post
The vulnerability exists in SIGB PMB version 8.0.1.14 within the /opac_css/ajax_selector.php component. The `id` and `datas` parameters are directly incorporated into SQL queries without proper sanitization or use of prepared statements. Attackers can inject malicious SQL code by crafting HTTP requests with manipulated parameters. This allows arbitrary SQL command execution, such as appending UNION SELECT statements to extract data. The injection occurs due to string concatenation of user input into query strings. Exploitation is possible via GET or POST requests to the vulnerable endpoint. Since the opac_css component is often publicly accessible, unauthenticated attacks may lead to data disclosure, authentication bypass, or full database compromise. The lack of input validation and escaping mechanisms enables these injections, making it critical for remote attackers to exploit.
Platform: SIGB PMB
Version: v8.0.1.14
Vulnerability: SQL Injection
Severity: Critical
Date: 11/25/2025
Prediction: Expected patch December
What Undercode Say:
Analytics:
Bash commands:
curl -s “http://target/opac_css/ajax_selector.php?id=1′ AND ‘1’=’1”
sqlmap -u “http://target/opac_css/ajax_selector.php?id=1” –batch
Code snippet:
$id = $_GET[‘id’];
$query = “SELECT FROM table WHERE id = ‘” . $id . “‘”;
how Exploit:
Craft requests with SQL payloads in id or datas parameters to execute arbitrary SQL commands.
Protection from this CVE:
Apply security patch, use parameterized queries, implement input validation.
Impact:
Data breach, unauthorized access, system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
