CVE-2011-5140

CVE-2011-5140 describes multiple SQL injection vulnerabilities within the blog module 1.0 for DiY-CMS, affecting both the blog module and the core DiY-CMS product. Attackers can exploit these flaws by manipulating the 'start', 'month', and 'year' parameters in various PHP scripts to execute arbitrary SQL commands. This vulnerability carries a CVSS score of 7.5 (High), indicating a low-complexity attack that can be performed remotely without authentication, potentially leading to compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.