This vulnerability involves SQL Injection (CWE-89) in MuuCMF T6 v1.9.4.20260115. An attacker can send crafted input via the keyword parameter in the Search.php controller endpoint to manipulate backend SQL queries. This can lead to full database compromise, unauthorized administrative access, and potentially remote code execution by writing malicious files to the server's filesystem. The CVSS 3.1 base score is 7.3, reflecting network attack vector, no privileges required, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published as of the vulnerability disclosure date.

Successful exploitation can lead to complete compromise of the database, unauthorized administrative control over the application, and potential remote code execution on the server hosting MuuCMF T6. This could allow attackers to manipulate data, disrupt service availability, and execute arbitrary code, severely impacting the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable endpoint, implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the keyword parameter, and monitor for suspicious activity related to this endpoint. Avoid exposing the affected application to untrusted networks if possible.