CVE-2026-75417: SQL Injection
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection, potentially leading to full database compromise.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires an authenticated administrator account. The affected input is the user-controlled parentid parameter processed by the administrative category controller.
What is the likely impact of successful exploitation?
An attacker can perform boolean-based blind SQL injection to execute arbitrary SQL queries. This can potentially result in full compromise of the database.
How can I determine whether my deployment is affected?
The issue is reported in YzmCMS 7.5, specifically in get_arrchildid() within application/admin/controller/category.class.php. Review that function to determine whether parentid is concatenated directly into a FIND_IN_SET() SQL clause without sanitization.