Executive brief
WuzhiCMS is a PHP-based content management system used to build and manage websites. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL queries against the underlying database by sending a specially crafted JSON POST request, potentially exposing all stored data including administrator credentials, user accounts, and sensitive business information.
Technical details
The vulnerability is a SQL injection flaw in the article::getDataOfJson function within /index.php. The function reads JSON-formatted request data directly from php://input, extracting the "title" and "master_table" parameters without any sanitization or parameterized query protection. These values are then concatenated directly into SQL strings. Because the JSON input path bypasses the framework's standard sql_replace() filter chain that applies to GET/POST parameters, SQL metacharacters like single quotes and backticks reach the SQL engine unescaped. An unauthenticated attacker can exploit this via a POST request to /index.php?m=content&f=article&v=getDataOfJson with no login or special privileges required. The injection enables error-based, time-based blind, and UNION-based data extraction, allowing full database disclosure including password hashes and salts. No patch has been publicly released as of the advisory date.
Affected products
- WuzhiCMS WuzhiCMS up to 4.1.0
Timeline
- 2026-09-15: disclosed: Public disclosure via GitHub issue #218 and NVD