CVE-2026-3292: jizhiCMS Batch Model.php findAll sql injection
A security vulnerability has been detected in jizhiCMS up to 2.5.6. Affected is the function findAll in the library frphp/lib/Model.php of the component Batch Interface. The manipulation of the argument data leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3292?
CVE-2026-3292 is rated as a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2026-3292?
To fix CVE-2026-3292, you should update jizhiCMS to version 2.5.7 or later, which addresses the SQL injection vulnerability.
What components are affected by CVE-2026-3292?
The affected component in CVE-2026-3292 is the findAll function within frphp/lib/Model.php in jizhiCMS up to version 2.5.6.
Can I exploit CVE-2026-3292 remotely?
Yes, CVE-2026-3292 can be exploited remotely, allowing attackers to manipulate database queries through the vulnerable function.
What kind of data can be compromised due to CVE-2026-3292?
CVE-2026-3292 can lead to unauthorized access to sensitive data in the database, including user information and application data.