| 标题 | YzmCMS 7.5 SQL Injection |
|---|
| 描述 | A SQL Injection vulnerability was discovered in YzmCMS v7.5 during the installation phase.
The issue resides in the file `/application/install/index.php`. The application retrieves the user-supplied 'siteurl' input via a POST request and processes it only with the `trim()` function. This variable is then directly concatenated into an UPDATE SQL statement without any sanitization or parameterized preparation (Prepared Statements), and executed via `$pdo->exec()`.
Defective Code:
$siteurl = trim($_POST['siteurl']);
$sql = "UPDATE `".$db_prefix."config` SET `value` = '$siteurl' WHERE `id` = 2";
$pdo->exec($sql);
An unauthenticated attacker can exploit this by manipulating the 'siteurl' parameter during the installation process. By using error-based SQL injection payloads (such as `updatexml`), the attacker can extract sensitive information from the database, including the database user, version, and administrator credentials, potentially leading to an administrative account takeover and subsequent Remote Code Execution (RCE) via backend template modifications. |
|---|
| 来源 | ⚠️ https://github.com/drose025/security/blob/main/1.md |
|---|
| 用户 | D.Rose (UID 46535) |
|---|
| 提交 | 2026-05-28 11時19分 (5 月前) |
|---|
| 管理 | 2026-06-28 09時59分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 374537 [YzmCMS 直到 7.5 index.php siteurl SQL注入] |
|---|
| 积分 | 20 |
|---|