CVE-2025-70397: Jizhicms SQL Injection Vulnerability

CVE-2025-70397 Overview

Jizhicms version 2.5.6 contains a SQL Injection vulnerability in the Article/deleteAll and Extmolds/deleteAll endpoints. The vulnerability exists due to improper sanitization of the data parameter, allowing authenticated attackers with administrative privileges to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, modification, or deletion of database contents.

Critical Impact

Authenticated attackers can execute arbitrary SQL queries through the vulnerable data parameter in deletion endpoints, potentially compromising the entire database.

Affected Products

• Jizhicms version 2.5.6
• Article/deleteAll endpoint
• Extmolds/deleteAll endpoint

Discovery Timeline

• 2026-02-17 - CVE CVE-2025-70397 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-70397

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the Jizhicms content management system version 2.5.6. The vulnerability is present in two administrative endpoints: Article/deleteAll and Extmolds/deleteAll. Both endpoints accept a data parameter that is not properly sanitized before being incorporated into SQL queries.

The network-accessible attack vector requires high-privileged (administrative) access to exploit, but once an attacker has such access, they can execute arbitrary SQL commands against the backend database. This could result in complete compromise of database confidentiality, integrity, and availability.

Root Cause

The root cause of this vulnerability is insufficient input validation and improper construction of SQL queries. The data parameter passed to the Article/deleteAll and Extmolds/deleteAll functions is directly incorporated into SQL statements without proper sanitization or use of parameterized queries. This allows an attacker to break out of the intended query structure and inject malicious SQL commands.

Attack Vector

The attack is conducted over the network against authenticated administrative sessions. An attacker with administrative credentials can craft malicious requests to the vulnerable endpoints, manipulating the data parameter to include SQL injection payloads. The injection point allows for various SQL injection techniques including:

• Union-based injection for data extraction
• Boolean-based blind injection for enumeration
• Time-based blind injection for covert data extraction
• Stacked queries for data manipulation (if supported by the database driver)

The vulnerability is exploited by sending specially crafted HTTP requests to either the Article/deleteAll or Extmolds/deleteAll endpoints with a malicious payload in the data parameter. For technical details on the exploitation mechanism, refer to the SQL Injection analysis on 23882 Blog.

Detection Methods for CVE-2025-70397

Indicators of Compromise

• Unusual database query patterns in application logs, particularly those targeting the Article/deleteAll or Extmolds/deleteAll endpoints
• HTTP requests containing SQL keywords (such as UNION, SELECT, DROP, INSERT) in the data parameter
• Database errors or unexpected query execution times indicating injection attempts
• Unauthorized data modifications or deletions in article or mold database tables

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in HTTP requests to Jizhicms administrative endpoints
• Monitor application logs for requests to Article/deleteAll and Extmolds/deleteAll with suspicious parameter values
• Deploy database activity monitoring to detect anomalous query patterns
• Enable verbose error logging (in non-production environments) to identify injection attempts

Monitoring Recommendations

• Configure alerts for repeated failed or unusual requests to the vulnerable endpoints
• Establish baseline database query patterns and alert on deviations
• Monitor administrative session activity for unusual bulk deletion operations
• Review access logs for administrative endpoints regularly

How to Mitigate CVE-2025-70397

Immediate Actions Required

• Restrict administrative access to trusted IP addresses only using firewall rules or application-level IP whitelisting
• Review and audit all administrative user accounts, removing unnecessary privileged access
• Implement additional authentication factors for administrative access
• Consider temporarily disabling the bulk delete functionality if not critical to operations

Patch Information

At the time of publication, no official vendor patch has been released for this vulnerability. Organizations should monitor the Jizhicms official website for security updates. Until a patch is available, implementing the recommended workarounds is essential to reduce exposure.

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection detection rules in front of the Jizhicms installation
• Implement input validation at the application layer by modifying the affected functions to use parameterized queries
• Restrict network access to administrative endpoints using network segmentation
• Consider migrating to an alternative CMS if patches are not released in a timely manner
• Enable database user privilege restrictions to limit the impact of successful SQL injection

# Example: Restrict access to admin endpoints using nginx
location ~ ^/admin/(Article|Extmolds)/deleteAll {
    allow 192.168.1.0/24;  # Allow only trusted network
    deny all;
}