CVE-2026-13529: YzmCMS SQL Injection Vulnerability

CVE-2026-13529 Overview

CVE-2026-13529 is a SQL injection vulnerability affecting YzmCMS versions up to 7.5. The flaw resides in an unspecified function within the /application/install/index.php file, where the siteurl parameter is not properly sanitized before being used in a database query. Attackers can manipulate the siteurl argument to inject arbitrary SQL statements over the network without authentication. The exploit has been publicly disclosed, though the vulnerability is rated as high complexity and difficult to exploit reliably. The vendor was contacted prior to public disclosure but did not respond. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Successful exploitation can allow remote attackers to read, modify, or extract data from the underlying database of an installed YzmCMS instance.

Affected Products

YzmCMS versions up to and including 7.5
Installation endpoint /application/install/index.php
Deployments where the installer remains accessible post-setup

Discovery Timeline

2026-06-29 - CVE-2026-13529 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13529

Vulnerability Analysis

The vulnerability affects YzmCMS, an open-source content management system written in PHP. The installer script located at /application/install/index.php accepts a siteurl request parameter that is passed into a database operation without adequate sanitization or parameterization. An unauthenticated remote attacker can supply crafted SQL payloads through the siteurl argument to alter the intended query logic.

Because the vulnerable code path resides in the installer, the exploit surface depends on whether the installer endpoint remains reachable after initial setup. Many CMS deployments leave installation scripts in place, exposing this attack path to remote clients. VulDB has classified the exploitability as difficult, reflecting the constraints imposed by installer state checks and the high attack complexity.

Root Cause

The root cause is improper neutralization of user-supplied input before it is embedded in a downstream SQL query, consistent with [CWE-74]. The siteurl parameter flows from the HTTP request into database logic without prepared statements or input filtering, allowing SQL syntax provided by the attacker to be interpreted by the database engine.

Attack Vector

Exploitation requires only network access to the vulnerable installer endpoint. The attacker sends an HTTP request to /application/install/index.php containing a manipulated siteurl parameter that carries SQL syntax. No authentication or user interaction is required. The public disclosure of the exploit lowers the barrier for opportunistic scanning against exposed YzmCMS installations.

No verified proof-of-concept code is included here. Refer to the GitHub Security Documentation and the VulDB CVE Record CVE-2026-13529 for public technical details.

Detection Methods for CVE-2026-13529

Indicators of Compromise

HTTP requests to /application/install/index.php containing SQL keywords such as UNION, SELECT, SLEEP, or -- in the siteurl parameter
Unexpected access to the installer endpoint on production YzmCMS deployments where installation has already completed
Database error messages or unusually long response times correlated with requests to the installer script

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the siteurl parameter for SQL metacharacters and common injection payloads
Enable database query logging and alert on queries containing unexpected clauses originating from the installer request context
Perform periodic authenticated vulnerability scans against internet-facing PHP applications to identify exposed installer scripts

Monitoring Recommendations

Monitor web server access logs for repeated or anomalous requests targeting /application/install/index.php
Correlate web requests with database audit logs to identify injection attempts that reach the backend
Track outbound network connections from the web server that could indicate data exfiltration following a successful injection

How to Mitigate CVE-2026-13529

Immediate Actions Required

Remove or block network access to /application/install/index.php on any YzmCMS deployment where installation is complete
Restrict the installer directory using web server access controls or by deleting the application/install directory after setup
Review web and database logs for evidence of prior exploitation attempts against the siteurl parameter

Patch Information

At the time of publication, the vendor has not responded to the disclosure and no official patch reference is available in the CVE data. Operators should track the YzmCMS project and the VulDB Vulnerability ID #374537 entry for updates. Until a fixed release is available, apply the workarounds below.

Workarounds

Delete or rename the application/install directory once initial site configuration is complete
Add web server rules that deny requests to the installer path from all external IP addresses
Deploy a WAF signature that blocks SQL metacharacters in the siteurl request parameter
Enforce least-privilege database credentials for the CMS application to limit the impact of any successful injection

bash

# Nginx configuration example to block external access to the YzmCMS installer
location ~* ^/application/install/ {
    allow 127.0.0.1;
    deny all;
    return 403;
}