Dreamer CMS v4.0.0 is vulnerable to SQL Injection. An attacker can send a specially crafted HTTP POST request with malicious SQL statements to the vulnerable search/doSearch script. This can allow the attacker to extract information from the database, modify data, or potentially execute arbitrary code.