# Pro3W CMS auth bypass via SQLi

Published: 2026-02-27 · Severity: high
Canonical: https://vorant.io/reports/113a21d5-6e11-55ae-abbf-685eb47854db/pro3w-cms-auth-bypass-via-sqli

> Pro3W CMS version 1.2.0 contains an SQL injection flaw in the login form allowing unauthenticated attackers to gain admin access.

CERT Polska disclosed CVE-2025-15498, a SQL injection vulnerability in Pro3W CMS that enables authentication bypass. An unauthenticated attacker can exploit improper input neutralization in the login form to gain administrative privileges without credentials. The vulnerability was confirmed in version 1.2.0, though the full affected version range remains undetermined due to lack of vendor response.

The vendor has not issued a formal response or patch advisory. CERT Polska indicates the vulnerability should be eliminated in versions released from January 2026 onward, but organizations running Pro3W CMS should verify their deployment status independently. The issue was responsibly disclosed by security researcher Jacek Czepil through CERT Polska's coordinated vulnerability disclosure process.

## Mentioned in this report

- Vulnerabilities: CVE-2025-15498

## Detection guidance (public sample)

### SQL Injection Attempt Against CMS Login Form

ATT&CK: T1190

Detects HTTP POST requests to a login endpoint containing classic SQL injection tokens, consistent with authentication-bypass exploitation such as CVE-2025-15498 in Pro3W CMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Attempt Against CMS Login Form
id: 1858ea04-4af7-5cc8-9aa1-4a31b884b35e
status: experimental
description: Detects HTTP POST requests to a login endpoint containing classic SQL
  injection tokens, consistent with authentication-bypass exploitation such as CVE-2025-15498
  in Pro3W CMS.
references:
- CERT Polska CVE-2025-15498 advisory
author: Vorant
tags:
- attack.t1190
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
    - login
    - signin
    - auth
  sqli_tokens:
    cs-uri-query|contains:
    - ''' OR ''1''=''1'
    - ''' OR 1=1'
    - UNION SELECT
    - ''' -- '
    - admin'--
    - ''' OR ''x''=''x'
    - SLEEP(
    - BENCHMARK(
  condition: selection and sqli_tokens
falsepositives:
- Security scanning or penetration testing tools probing login forms
- Automated vulnerability assessment platforms
level: high
```

### Administrative Privilege Grant Following Unauthenticated Login POST

ATT&CK: T1078

Detects an HTTP 200/302 success response to a login POST request containing SQL injection syntax, indicating an unauthenticated attacker was granted administrative session/privileges via auth-bypass SQLi. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Administrative Privilege Grant Following Unauthenticated Login POST
id: 9c5d4e6b-05de-5841-8827-46f942c1f2c8
status: experimental
description: Detects an HTTP success response to a login POST request whose query/body
  contains SQL injection syntax, indicating a likely authentication bypass granting
  administrative access without valid credentials (e.g. CVE-2025-15498 in Pro3W CMS).
references:
- CERT Polska CVE-2025-15498 advisory
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
    - login
    - signin
    - auth
    sc-status:
    - 200
    - 302
  sqli_tokens:
    cs-uri-query|contains:
    - ''' OR ''1''=''1'
    - ''' OR 1=1'
    - UNION SELECT
    - admin'--
    - ''' OR ''x''=''x'
  condition: selection and sqli_tokens
falsepositives:
- Penetration testing or authorized security assessments exercising the same login
  flow
- Web application firewalls or scanners replaying known SQLi payloads for coverage
  testing
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/02/CVE-2025-15498

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/113a21d5-6e11-55ae-abbf-685eb47854db/pro3w-cms-auth-bypass-via-sqli.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup