Description
A remote SQL injection vulnerability exists in Foojan WMS 1.0 through the story parameter in index.php. The parameter is used in database queries without proper sanitization.
Impact
Attackers can inject arbitrary SQL commands to extract, modify, or delete data from the database, including all CMS content and user credentials.
Solution
Apply parameterized queries to the story parameter. Validate all user input.