Executive brief
MuuCMF T6, a content management system and development framework, contains a security flaw in its search functionality. An unauthenticated attacker can use this flaw to access or modify the entire underlying database without needing a password. In some server configurations, this could allow an attacker to take full control of the server, leading to data theft, service disruption, or unauthorized administrative access.
Technical details
A SQL injection vulnerability exists in the `keyword` parameter of the `/index/controller/Search.php` endpoint in MuuCMF T6. The root cause is the use of the `whereRaw()` function in the `getListByPage()` method within `app/common/model/Base.php`. When the `$map` variable (constructed from user input) is passed as a string rather than an array, the ThinkPHP6-based framework executes it as raw SQL. Although the application attempts to sanitize input by splitting on whitespace, attackers can bypass this using SQL comments (`/**/`) to represent spaces. Successful exploitation allows unauthenticated attackers to extract sensitive data, bypass authentication, or, if `secure_file_priv` is misconfigured, achieve Remote Code Execution (RCE) by writing a web shell to the file system.
Affected products
- MuuCMF (Beijing Huomu Technology Co., Ltd.) MuuCMF T6 v1.9.4.20260115, v1.9.5.20260309
Timeline
- 2026-03-24: disclosed: Initial researcher write-up published
- 2026-05-11: advisory: CVE published to NVD dataset