CVE-2026-91848: WuzhiCMS SQL Injection Vulnerability

CVE-2026-91848 Overview

CVE-2026-91848 is a SQL injection vulnerability in WuzhiCMS versions up to 4.1.0. The flaw resides in the article::getDataOfJson function accessed via /index.php?m=content&f=article&v=getDataOfJson. Attackers can manipulate the title and master_table parameters to inject arbitrary SQL statements. Remote exploitation requires no authentication or user interaction. Public exploit details are available, and the WuzhiCMS project has not responded to the issue report filed against the repository. The weakness is classified as [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact

Unauthenticated remote attackers can inject SQL through the title or master_table parameters, exposing database contents and integrity.

Affected Products

• WuzhiCMS versions up to and including 4.1.0
• Endpoint: /index.php?m=content&f=article&v=getDataOfJson
• Vulnerable function: article::getDataOfJson

Discovery Timeline

• 2026-09-15 - CVE-2026-91848 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91848

Vulnerability Analysis

The vulnerability exists in the getDataOfJson method of the article controller within WuzhiCMS. The endpoint accepts user-controlled input through the title and master_table HTTP parameters. These values are incorporated into backend SQL queries without adequate neutralization of SQL metacharacters. An attacker can craft requests to /index.php?m=content&f=article&v=getDataOfJson that alter query structure, retrieve arbitrary rows, or manipulate the underlying database. Exploitation is remote and does not require prior authentication. According to the reference material, exploit details are publicly circulated, which raises the practical risk of opportunistic scanning against exposed WuzhiCMS installations.

Root Cause

The root cause is improper input neutralization ([CWE-74]) in the article::getDataOfJson handler. The master_table parameter appears to influence the SQL FROM clause, while title is used within WHERE conditions. Neither value is bound through prepared statements or filtered against an allowlist before being concatenated into the query string. This design allows attacker-supplied SQL fragments to reach the database engine.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends a crafted GET or POST request to the vulnerable endpoint with malicious payloads in the title or master_table parameters. Because no authentication is required, any internet-reachable WuzhiCMS instance running a vulnerable release is exposed. Successful injection can lead to disclosure of stored credentials, session tokens, and administrative content. For technical proof-of-concept details, see the GitHub Wuzhicms Issue #218 and the VulDB entry for CVE-2026-91848.

Detection Methods for CVE-2026-91848

Indicators of Compromise

• HTTP requests to /index.php?m=content&f=article&v=getDataOfJson containing SQL keywords such as UNION, SELECT, SLEEP, or comment sequences (--, /*) in the title or master_table parameters.
• Unexpected values in the master_table parameter that do not match legitimate application table names.
• Web server logs showing repeated requests to the endpoint from a single source with varying parameter payloads.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect query strings on the getDataOfJson endpoint for SQL injection patterns.
• Enable database query logging and alert on anomalous queries against the WuzhiCMS content tables, particularly queries with UNION operators or boolean-based blind injection patterns.
• Correlate HTTP access logs with database error rates to identify probing behavior.

Monitoring Recommendations

• Monitor outbound traffic from the web server host for unusual data volumes that may indicate database exfiltration.
• Track authentication table access and alert on read operations from non-application processes.
• Review scheduled scans and CI pipeline results for signatures matching CVE-2026-91848.

How to Mitigate CVE-2026-91848

Immediate Actions Required

• Restrict public access to /index.php?m=content&f=article&v=getDataOfJson via WAF or reverse proxy rules until a fix is available.
• Audit web server logs for prior exploitation attempts and rotate any credentials stored in the WuzhiCMS database.
• Enforce least-privilege database accounts for the WuzhiCMS application, removing DDL and cross-database privileges.

Patch Information

As of the last modification date (2026-09-16), the WuzhiCMS project has not published a patch. The vendor has not responded to the GitHub issue #218 tracking the vulnerability. Monitor the WuzhiCMS repository for future security releases addressing the article::getDataOfJson handler.

Workarounds

• Block or filter requests to the vulnerable endpoint at the network edge using WAF signatures targeting SQL metacharacters in the title and master_table parameters.
• Apply a local source-code patch that validates master_table against an allowlist of legitimate table names and uses parameterized queries for the title value.
• Consider disabling the affected module if the getDataOfJson functionality is not required for site operations.

# Example nginx rule to block SQL injection patterns on the vulnerable endpoint
location ~ ^/index\.php {
    if ($args ~* "m=content&f=article&v=getDataOfJson.*(union|select|sleep|--|/\*)") {
        return 403;
    }
}