CVE-2026-3325: MegaCMS SQL Injection via id_territorio Parameter
CVE-2026-3325 is a SQL injection flaw in MegaCMS v12.0.0, located in the id_territorio parameter of the /web_comunications/cms/get_provincias endpoint. The CNA, INCIBE-CERT, rates it critical with a CVSS 4.0 base score of 10, and the record describes it as reachable without authentication during the registration flow. No confirmed exploitation appears in the sources consulted, and the record provides no affected or fixed version data.
Overview
CVE-2026-3325 describes an SQL injection weakness (CWE-89) in MegaCMS v12.0.0. The affected input is the id_territorio parameter, sent through a POST request to the /web_comunications/cms/get_provincias endpoint. According to the record, the parameter is used right after the registration form is submitted.
Impact
The CNA's CVSS 4.0 vector marks confidentiality, integrity and availability impacts as high on the vulnerable system, with a low impact on the subsequent system for availability. The record states that an unauthenticated attacker could use this parameter to run arbitrary SQL queries. The practical consequences depend on the database permissions and deployment, which the record does not describe.
Affected products and versions
- Product: MegaCMS, version 12.0.0 as stated in the record.
- The record's affected list is empty, so other versions cannot be confirmed or excluded from the available data.
- The record contains no fixed version. The absence of a listed fix does not mean no fix exists; it means the sources consulted do not provide one.
Exploitation status
The CISA KEV catalogue does not list this CVE in the record, so no active exploitation is claimed here. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00453 with a percentile of 0.37568 as recorded.
Remediation and mitigation
- Check the official INCIBE-CERT notice for vendor or maintainer guidance: INCIBE-CERT notice.
- Identify every MegaCMS installation and confirm its version. Treat version 12.0.0 as in scope until the vendor confirms otherwise.
- Restrict or temporarily protect the registration flow and the affected endpoint while a fix is pending, for example by limiting exposure to the internet.
- Ensure the application uses parameterised queries and strict input validation for all territory and location fields.
- Apply least privilege to the database account used by the application.
Detection guidance
- Review web server and application logs for unusual POST requests to the get_provincias endpoint, especially with abnormal or non-numeric values in id_territorio.
- Monitor database logs for errors or unexpected query patterns originating from the web application.
- Consider web application firewall rules that flag SQL metacharacters in request parameters, understanding that these are a compensating control and not a fix.
Limitations of the available information
- The record gives no affected version range beyond 12.0.0, no fixed version and no vendor patch reference.
- The record's title field is empty; the titles here are derived from the description.
- The record lists a reference to an INCIBE-CERT notice but its contents were not available in the record, so details beyond the record are unknown.
- The CVSS 4.0 base score is provided by the CNA; no other CVSS scores are present in the record.
Frequently asked questions
What is CVE-2026-3325?
It is an SQL injection vulnerability in MegaCMS v12.0.0, found in the id_territorio parameter of the /web_comunications/cms/get_provincias endpoint.
How severe is it according to the record?
The CNA INCIBE-CERT assigns a critical rating with a CVSS 4.0 base score of 10.
Is this vulnerability known to be exploited?
The CISA KEV catalogue does not list it in this record, and no confirmed exploitation appears in the sources consulted.
Which version is fixed?
The record does not provide a fixed version. Check the INCIBE-CERT notice and the vendor for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.