CVE-2026-75417 in YzmCMS
Summary
by MITRE • 08/28/2026
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection, potentially leading to full database compromise.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in YzmCMS version 7.5 represents a critical security flaw rooted in improper input validation and the direct concatenation of user-supplied data into SQL query structures. Specifically, this issue resides within the get_arrchildid() function located in the application/admin/controller/category.class.php file. The core technical failure involves the parentid parameter, which is expected to be an integer identifier for a category hierarchy but is instead accepted as raw input and embedded directly into a FIND_IN_SET SQL clause without adequate sanitization or type casting. This architectural oversight allows an attacker who has obtained valid administrative credentials to manipulate the query logic by injecting malicious payloads that alter the intended boolean evaluation of the database statement.
From a technical perspective, this vulnerability facilitates boolean-based blind injection, a sophisticated technique where the attacker infers data from the application's response based on true or false conditions rather than direct error messages or result sets. By carefully crafting requests that trigger different responses depending on whether injected SQL expressions evaluate to true or false, an authenticated administrator can systematically extract sensitive information from the underlying database schema. This process does not require immediate visibility of query results in the HTTP response but relies on subtle differences in application behavior, such as page load times or conditional content rendering, which are characteristic of blind injection vectors.
The operational impact of this vulnerability is severe due to the high privilege level required for exploitation and the comprehensive access it grants once achieved. Although the attack vector requires authentication as an administrator, many web applications suffer from weak credential hygiene, making such accounts accessible through brute-force attacks or credential stuffing if multi-factor authentication is not enforced. Once authenticated, the ability to execute arbitrary SQL queries means that attackers can read sensitive data including user credentials, personal identifiable information, and proprietary business logic stored in the database. In worst-case scenarios involving certain database configurations, this could potentially lead to remote code execution through features like INTO OUTFILE or xp_cmdshell, although boolean-based blind injection primarily focuses on data exfiltration first.
This vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and is categorized under the ATT&CK framework technique T1059 Command and Scripting Interpreter via database commands when considering the broader implications of arbitrary code execution potential, though strictly it falls under data exfiltration techniques like T1005 Data from Local System. The lack of parameterized queries or prepared statements in the get_arrchildid function is a fundamental deviation from secure coding standards recommended by OWASP and other industry bodies for preventing injection flaws.
Mitigation strategies must prioritize immediate remediation through code modification to enforce strict type casting on all user inputs before they are used in database operations. The parentid parameter should be explicitly cast as an integer or validated against a whitelist of expected values using server-side validation logic that rejects any non-numeric input. Additionally, implementing prepared statements with bound parameters would ensure that the SQL engine treats input data strictly as literal values rather than executable code parts. Beyond immediate patching, organizations should enforce strong password policies and multi-factor authentication for all administrative accounts to reduce the attack surface available to potential intruders who might attempt to exploit this flaw after gaining initial access through other means. Regular security audits and static application security testing focused on SQL injection patterns are also essential to detect similar vulnerabilities in other parts of the CMS codebase before they can be exploited in production environments.