CVE-2026-73670 is a SQL injection vulnerability in Saurus CMS Community Edition located in admin/db_data.php at line 509. The vulnerability arises from improper neutralization of special elements in the table_name GET or POST parameter, which is used in a SHOW COLUMNS FROM SQL statement without proper sanitization. Authenticated administrators can exploit this to perform various SQL injection techniques including table traversal, time-based blind, boolean-based blind, and error-based injections. These techniques enable full enumeration of the database schema, access to system tables such as information_schema, and chaining with secondary injection points to extract sensitive credential data.

An attacker with authenticated administrator access can leverage this vulnerability to execute arbitrary SQL commands on the database. This can lead to full disclosure of the database schema, access to sensitive system tables, and extraction of credential data. The vulnerability has a high severity score (CVSS 8.6) indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL injection attempts targeting the table_name parameter.