SQLi At `███████` via `theme_name`

Summary

A critical SQL injection vulnerability was discovered in a web application's theme selection endpoint through the theme_name parameter. Using SQLMap, the researcher demonstrated both error-based and time-based blind injection attacks against a MySQL database (version 5.1+). The exploitation successfully enumerated thirteen databases, including sensitive repositories for authentication, payment, and security data. The development team promptly implemented fixes using parameterized queries and input validation. Post-remediation testing confirmed the vulnerability was fully resolved. We appreciate the detailed proof-of-concept and responsible disclosure that facilitated swift remediation of this critical security flaw.