| शीर्षक | EyouCMS 1.7.6 Command Injection |
|---|
| विवरण | EyouCMS version 1.7.6 contains a SQL Injection vulnerability in the backend template management functionality that leads to Remote Code Execution. The file manager implements incomplete input validation that only blocks {eyou:php} template tags while allowing {eyou:sql} tags. The {eyou:sql} tag handler executes arbitrary SQL queries with minimal restrictions (only blocking DELETE and TRUNCATE). By using MySQL INTO OUTFILE, an authenticated administrator can write malicious PHP files to the webroot, achieving remote code execution. |
|---|
| स्रोत | ⚠️ https://note-hxlab.wetolink.com/share/XfINjg5i25Ud |
|---|
| उपयोगकर्ता | yu22x (UID 34832) |
|---|
| सबमिशन | 16/12/2025 02:20 AM (4 महीनों पहले) |
|---|
| संयम | 27/12/2025 12:24 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338521 [EyouCMS तक 1.7.6 Backend Template Management FilemanagerLogic.php content SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|