CyberRota Analysis
AI-GeneratedYzmCMS 7.5 contains a SQL injection vulnerability in the get_arrchildid() function, where the unsanitized user-controlled parentid parameter is directly included in a SQL query. This flaw allows authenticated administrators to perform arbitrary SQL queries through boolean-based blind injection, potentially resulting in full database compromise. Organizations using YzmCMS should prioritize addressing this vulnerability to mitigate the risk of unauthorized data access and integrity loss.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection, potentially leading to full database compromise.