YzmCMS up to 7.6 MD5 system.func.php password pass weak password hash

Summaryinfo

A vulnerability marked as problematic has been reported in YzmCMS up to 7.6. The affected element is the function Password of the file /common/function/system.func.php of the component MD5 Handler. The manipulation of the argument pass leads to weak password hash. This vulnerability is referenced as CVE-2026-105156. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."

Detailsinfo

A vulnerability was found in YzmCMS up to 7.6 and classified as problematic. This issue affects the function password of the file /common/function/system.func.php of the component MD5 Handler. The manipulation of the argument pass with an unknown input leads to a weak password hash vulnerability. Using CWE to declare the problem leads to CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. Impacted is confidentiality.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-105156. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

The exploit is available at github.com. It is declared as proof-of-concept. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk." By approaching the search of inurl:common/function/system.func.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• YzmCMS

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #953155: YzmCMS V7.6 Weak Encoding for Password (by Witiers)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion