CVE-2026-38930

Vulnerability

RapidCMS v1.3.1 contains an authentication bypass vulnerability in the /template/default/menu.php component. The application uses cookies named name and user for authentication. The name cookie parameter is directly incorporated into an SQL query without proper sanitization, allowing injection of crafted SQL payloads. The vulnerability is triggered by sending a specially crafted HTTP cookie request containing a SQL injection payload in the name cookie [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by first registering a legitimate user account and logging in to obtain valid cookie values. Using browser developer tools, the attacker observes the user and name cookies. The attacker then modifies the user cookie to a calculated value based on the application's internal encode() function, and sets the name cookie to a SQL injection payload such as test" and 0 union select "test"#. After refreshing the page, the manipulated cookies cause the authentication query to return a different result, thereby bypassing authentication [1].

Impact

Successful exploitation allows an attacker to bypass authentication and gain unauthorized access to the application. The attacker can then perform actions as an authenticated user, potentially including viewing, modifying, or deleting content managed by RapidCMS. The exact scope of unauthorized access depends on the privileges of the user whose session is impersonated, but the vulnerability effectively undermines access control [1].

Mitigation

As of the publication date, no patch has been released by OpenRapid. The vendor has not announced a fix or workaround. Users are advised to monitor the official vendor repository for updates. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date [1].