Raytha CMS contains a critical SQL Injection vulnerability (CWE-89) in its OData filter parsing pipeline. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL statements against the PostgreSQL database backend. This can result in complete database compromise, including extraction of sensitive credentials. The vulnerability is confirmed in version 1.5.2; other versions have not been confirmed but may be vulnerable. Attempts to contact the vendor were unsuccessful, and no official patch or fix information is available at this time.

Successful exploitation enables remote, unauthenticated attackers to execute arbitrary SQL commands on the database, leading to full compromise of the database contents. This includes the potential theft of credentials and other sensitive data stored within the database. The severity is critical due to the unauthenticated remote attack vector and the high impact on confidentiality and integrity of data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no vendor contact or patch information is available, users should monitor for official updates from the vendor. Until a fix is available, consider restricting access to the OData filter functionality or applying network-level controls to limit exposure.