CVE-2026-120349 in XunRuiCMS
Summary
by MITRE • 11/02/2026
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Dayrui XunRuiCMS versions up to 4.7.4 represents a critical remote code execution risk stemming from improper input validation within the Mobile Site Directory component. Specifically, the flaw resides in the index.php file located at /var/www/html/zzmob/index.php and involves the misuse of the PHP str_replace function. In this context, the application processes user-supplied data through an argument named dirname without adequate sanitization or type checking before passing it to string replacement operations. This architectural oversight allows attackers to manipulate the input in a way that bypasses intended logic controls, leading directly to code injection. The nature of this flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection), where untrusted data is used to construct dynamic code or commands that are then executed by the application environment.
The operational impact of this vulnerability is severe due to its remote exploitability and the availability of public proof-of-concept exploits. An attacker can launch a remote attack without requiring prior authentication, leveraging the flaw to inject malicious payloads into the server's execution context. By manipulating the dirname parameter, an adversary can potentially execute arbitrary system commands or PHP code on the underlying web server. This capability effectively compromises the confidentiality, integrity, and availability of the affected system. Since XunRuiCMS is often deployed in content management scenarios where data sensitivity varies, successful exploitation could lead to full server compromise, allowing attackers to install backdoors, exfiltrate sensitive database contents, or pivot further into internal networks. The fact that exploit code has been released publicly significantly lowers the barrier for entry, enabling less sophisticated threat actors to conduct automated attacks against vulnerable instances.
From a defensive posture perspective, this incident highlights the dangers of relying on simple string manipulation functions like str_replace for security-critical input filtering without considering edge cases and injection vectors. The vulnerability is also consistent with ATT&CK technique T1059 Command and Scripting Interpreter, as it enables an attacker to execute commands via the web server environment. Furthermore, it reflects CWE-20 Improper Input Validation, where the application fails to verify that user input conforms to expected formats or constraints before processing. The lack of response from the vendor during early disclosure attempts underscores a common challenge in open-source and commercial CMS ecosystems where timely patching is not guaranteed. Organizations running affected versions must treat this as a high-priority remediation item given the active exploitation landscape.
Mitigation strategies should prioritize immediate isolation or upgrading to a patched version if one becomes available from Dayrui, although the lack of vendor engagement suggests users may need to rely on community patches or alternative solutions. In the interim, network-level controls such as Web Application Firewalls can be configured to detect and block requests containing suspicious patterns associated with code injection attempts targeting the /zzmob/index.php endpoint. Input validation should also be enforced at the application layer by implementing strict allow-listing for expected directory structures rather than relying on replacement logic that may inadvertently preserve malicious payloads. Regular security audits of CMS deployments are essential to identify similar misconfigurations in other components, ensuring that remote code execution vectors are systematically eliminated across the infrastructure.