Executive brief
YzmCMS is a lightweight open-source content management system used to build websites. A SQL injection vulnerability in the category management function allows authenticated administrators to execute arbitrary database queries, potentially exposing or modifying all data stored in the database.
Technical details
The vulnerability is a SQL injection flaw in the get_arrchildid() function within application/admin/controller/category.class.php. The parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization or parameterized queries. An authenticated administrator can exploit this via boolean-based blind SQL injection to execute arbitrary queries against the database. The vulnerability requires admin authentication, but allows full database compromise once authenticated.
Affected products
- YzmCMS YzmCMS 7.5
Timeline
- 2026-08-28: disclosed