CVE-2026-75417: YzmCMS 7.5 SQL Injection Vulnerability

CVE-2026-75417 Overview

CVE-2026-75417 is a SQL injection vulnerability in YzmCMS 7.5, an open-source PHP content management system. The flaw resides in the get_arrchildid() function within application/admin/controller/category.class.php. The function concatenates the user-controlled parentid parameter directly into a FIND_IN_SET() SQL clause without sanitization. An authenticated administrator can inject arbitrary SQL through boolean-based blind injection techniques. Successful exploitation enables full database compromise, including exfiltration of user credentials, session data, and administrative configuration. The vulnerability is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated administrators can extract or modify arbitrary database contents through boolean-based blind SQL injection in the YzmCMS category management endpoint.

Affected Products

YzmCMS 7.5
YzmCMS versions using the vulnerable category.class.php controller
Deployments exposing the admin category management interface

Discovery Timeline

2026-08-28 - CVE-2026-75417 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-75417

Vulnerability Analysis

The vulnerability exists in the category management logic of YzmCMS 7.5. The get_arrchildid() function recursively resolves child category identifiers by querying the categories table with a FIND_IN_SET() clause. The parentid parameter received from the admin request flows directly into the SQL string. No parameter binding or type coercion is applied before query construction. This allows an attacker to break out of the intended clause and append conditional expressions. Because the function returns aggregated identifiers rather than raw query output, exploitation relies on boolean-based blind techniques. Attackers infer data one bit at a time by observing differences in the application response. Full database extraction is feasible through automated tooling such as sqlmap.

Root Cause

The root cause is unsanitized concatenation of the parentid request parameter into a dynamically constructed SQL statement. YzmCMS does not enforce integer casting or use parameterized queries in the affected code path. Any admin-authenticated request reaching get_arrchildid() propagates attacker-controlled input into the database engine.

Attack Vector

Exploitation requires valid administrator credentials, which raises the privilege bar but does not mitigate insider abuse, credential theft, or chained authentication flaws. The attack is remote and network-reachable through the admin panel. An authenticated attacker crafts a request containing a malicious parentid value with SQL payloads such as boolean conditions appended after a comma or closing parenthesis. The vulnerable endpoint executes the modified query and returns different application states depending on the injected condition. See the GitHub CVE-2026-75417 Details writeup for the full technical proof of concept.

No verified exploit code is reproduced here. Technical details are available in the GitHub PoC Repository.

Detection Methods for CVE-2026-75417

Indicators of Compromise

Admin panel requests containing SQL metacharacters such as single quotes, parentheses, AND, OR, SLEEP, or BENCHMARK in the parentid parameter
Repeated requests to the category management controller with incrementing numeric payloads consistent with blind extraction
Unusual spikes in query volume against the categories table originating from admin sessions
Web server logs showing long or URL-encoded parentid values under /admin/category

Detection Strategies

Deploy web application firewall rules that flag SQL syntax in the parentid parameter of YzmCMS admin routes
Enable MySQL general query logging and alert on FIND_IN_SET queries containing boolean tautologies or subqueries
Correlate admin authentication events with anomalous category endpoint activity to identify compromised accounts

Monitoring Recommendations

Monitor administrator session activity for high-frequency requests to category.class.php endpoints
Track database error rates and slow query logs for patterns consistent with time-based or boolean-based inference
Alert on new administrator account creation or privilege changes following suspicious category requests

How to Mitigate CVE-2026-75417

Immediate Actions Required

Restrict access to the YzmCMS admin interface using IP allowlists or VPN gating until a patch is applied
Rotate all administrator credentials and enforce multi-factor authentication on admin accounts
Audit administrator accounts and remove unused or dormant privileged users
Review database logs for signs of prior exploitation targeting the categories table

Patch Information

No official vendor advisory or patched release has been published at the time of NVD publication. Monitor the YzmCMS GitHub project for security updates and apply any released fix that replaces string concatenation in get_arrchildid() with parameterized queries or strict integer casting of parentid.

Workarounds

Apply a local code fix that casts parentid to an integer with intval() before it reaches the FIND_IN_SET() clause
Place the admin panel behind an authenticated reverse proxy that inspects and rejects SQL syntax in request parameters
Limit database user privileges for the YzmCMS application account to the minimum required, blocking INFORMATION_SCHEMA access where feasible

bash

# Example WAF rule (ModSecurity) to block SQL syntax in parentid
SecRule ARGS:parentid "@rx (?i)(union|select|sleep|benchmark|--|'|\"|\)|and\s+\d+=\d+|or\s+\d+=\d+)" \
    "id:1075417,phase:2,deny,status:403,msg:'CVE-2026-75417 YzmCMS SQLi attempt in parentid'"