CVE-2025-14011: JIZHICMS Add Display Name Field addcomment.html commentlist sql injection
A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Comment/addcomment.html of the component Add Display Name Field. Performing a manipulation of the argument aid/tid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14011?
CVE-2025-14011 is rated as a critical vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2025-14011?
To fix CVE-2025-14011, update JIZHICMS to version 2.5.6 or later where the vulnerability has been addressed.
What can be exploited in CVE-2025-14011?
CVE-2025-14011 can be exploited through the commentlist function in the Add Display Name Field component by manipulating the aid/tid arguments.
What software is affected by CVE-2025-14011?
CVE-2025-14011 affects JIZHICMS versions up to and including 2.5.5.
What type of vulnerability is CVE-2025-14011?
CVE-2025-14011 is an SQL injection vulnerability that can allow attackers to execute malicious SQL queries.