| Название | JizhiCMS JiZhiCMS v2.5.6 SQL injection |
|---|
| Описание | This feature point decodes user input through the htmlspecialchars_decode() function. The prepended code only performs simple filtering on the user input content. The SQL statement content constructed by the attacker is decoded and directly concatenated into the SQL statement, exploiting time-blind injection to achieve SQL injection. |
|---|
| Источник | ⚠️ https://github.com/qingyun985/Cyber-Security/issues/4 |
|---|
| Пользователь | qingyunsec (UID 96803) |
|---|
| Представление | 02.04.2026 10:36 (6 месяцы назад) |
|---|
| Модерация | 24.04.2026 20:52 (22 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 359521 [JiZhiCMS до 2.5.6 addcache.html htmlspecialchars_decode sqls SQL-инъекция] |
|---|
| Баллы | 19 |
|---|