CVE-2021-44135: 
PHP vulnerability analysis and mitigation

Pagekit all versions, as of October 15, 2021, is vulnerable to SQL Injection via Comment listing. The vulnerability was assigned CVE-2021-44135 and was publicly disclosed on April 1, 2022. The vulnerability affects the Pagekit CMS, which is a modular and lightweight CMS built with Symfony components and Vue.js (MITRE CVE).

The vulnerability exists in the configAction in SettingsController, which allows users to set the order of comments listing using ascending (ASC) and descending (DESC) parameters. The configuration gets concatenated directly to the SQL query without proper sanitization. The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity (Qualys Report).

Due to the critical CVSS score of 9.8, this vulnerability could allow attackers to execute arbitrary SQL commands on the affected database, potentially leading to unauthorized access to sensitive data, modification of database contents, or complete compromise of the database system (CISA Bulletin).

The vulnerability is highly exploitable as it requires no authentication (PR:N) and no user interaction (UI:N) to exploit. The attack complexity is low (AC:L), making it relatively straightforward for attackers to exploit the vulnerability (Qualys Report).