CVE-2026-90708 Overview
CVE-2026-90708 is a SQL injection vulnerability in Yot CMS versions up to 3.3.1. The flaw resides in the Login function of global.php, part of the Cookie Handler component. Attackers can manipulate the yot3_user and yot3_pass cookie parameters to inject arbitrary SQL. The published proof-of-concept demonstrates cookie-based auto-login abuse to forge administrator sessions. Exploitation requires no authentication and can be executed remotely over the network. The issue is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Remote, unauthenticated attackers can inject SQL through cookie values to bypass authentication and forge administrator sessions in Yot CMS.
Affected Products
- Yot CMS versions up to and including 3.3.1
- global.php (Cookie Handler component)
- Deployments exposing the login cookie flow to the network
Discovery Timeline
- 2026-09-14 - CVE-2026-90708 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90708
Vulnerability Analysis
The vulnerability exists in the Login function within global.php, which processes the yot3_user and yot3_pass cookie values during auto-login. The Cookie Handler passes these attacker-controlled values into a SQL query without proper neutralization. As a result, crafted cookies alter the query structure and return arbitrary rows. The public proof-of-concept shows how the injection is used to authenticate as an administrator without valid credentials. Because the input travels through the cookie header, standard form-based input validation controls do not intercept it.
Root Cause
The root cause is improper neutralization of user-supplied cookie data before its use in a SQL statement, consistent with [CWE-74]. The Login routine trusts the yot3_user and yot3_pass cookie values and concatenates them into the query rather than using parameterized statements or strict input validation.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the Yot CMS application with malicious yot3_user or yot3_pass cookie values. The injected SQL manipulates the auto-login lookup, producing a forged administrator session. Refer to the GitHub proof-of-concept and VulDB advisory for technical detail.
Detection Methods for CVE-2026-90708
Indicators of Compromise
- Requests to Yot CMS endpoints containing SQL metacharacters (', --, UNION, SELECT) inside the yot3_user or yot3_pass cookies.
- Unexpected administrator sessions established without a preceding successful POST to the login form.
- Web server or application logs showing repeated cookie-based auto-login attempts from a single source IP.
Detection Strategies
- Inspect HTTP cookie headers at the WAF or reverse proxy for SQL injection patterns targeting yot3_user and yot3_pass.
- Enable database query logging and alert on syntactically unusual queries originating from the Login code path in global.php.
- Correlate administrator privilege actions with the absence of a corresponding interactive login event.
Monitoring Recommendations
- Forward web server, WAF, and database logs to a centralized analytics platform for correlation across the auto-login flow.
- Baseline normal cookie value structure for yot3_user and yot3_pass and alert on deviations in length or character set.
- Monitor for administrator account activity from previously unseen IP addresses or user agents.
How to Mitigate CVE-2026-90708
Immediate Actions Required
- Restrict network exposure of Yot CMS instances running version 3.3.1 or earlier until a fix is applied.
- Deploy WAF rules that block SQL injection payloads inside the yot3_user and yot3_pass cookies.
- Invalidate existing auto-login cookies and force re-authentication for all administrator accounts.
- Audit administrator accounts and recent privileged actions for signs of unauthorized access.
Patch Information
No vendor patch is referenced in the enriched CVE data at the time of publication. Monitor the VulDB entry for CVE-2026-90708 and the Yot CMS project for an official update. Upgrade to a fixed release once available.
Workarounds
- Disable the cookie-based auto-login feature in Yot CMS until a patched version is deployed.
- Enforce strict server-side validation of cookie values, rejecting non-alphanumeric input for yot3_user and yot3_pass.
- Place the application behind an authenticating reverse proxy to reduce unauthenticated network exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.