| शीर्षक | yanyutao0402 ChanCMS <=3.3.2 SQL Injection |
|---|
| विवरण | A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2. It has been rated as critical. After downloading the source code and deploying it directly, an attacker can log in to the backend at `/public/admin/index.html` using the weak default credentials `chancms/123456`.
Code auditing revealed that the `update` function in `/cms/article/update` does not validate the `cid` parameter.
By manipulating the `cid` argument, an attacker can perform SQL injection.
This vulnerability can be exploited remotely. It is recommended to fix the parameter validation issue or upgrade to a secure version.
|
|---|
| स्रोत | ⚠️ https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md#111 |
|---|
| उपयोगकर्ता | Narcher (UID 91355) |
|---|
| सबमिशन | 07/10/2025 09:05 AM (12 महीनों पहले) |
|---|
| संयम | 17/10/2025 09:22 AM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 328913 [yanyutao0402 ChanCMS तक 3.3.2 /cms/article/update cid SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|