What is the CVSS score of CVE-2025-50229?

CVE-2025-50229 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of JizhiCMS are affected by CVE-2025-50229?

JizhiCMS v2.5.4 contains a critical SQL injection vulnerability in the product editing module that could allow attackers with administrative access to query, modify, or delete the application…

How to fix or mitigate CVE-2025-50229?

Within 24 hours: identify all JizhiCMS v2.5.4 instances in your environment and document their exposure; restrict network access to the product editing module to internal trusted networks and enforce multi-factor authentication on all administrative accounts. Within 7 days: deploy Web Application Firewall rules to block SQL injection payloads in product editing endpoints; enable detailed audit logging for all administrative module access with alerting on suspicious activity. Within 30 days: contact the vendor for a patch timeline; if a patch is released, plan and execute immediate deployment; if no patch is available after 60 days, begin migration planning to an alternative CMS platform or implement input validation controls at the application layer.

JizhiCMS CVE-2025-50229

EUVD-2025-209568 CRITICAL

SQL Injection (CWE-89)

2026-04-23 mitre

SQLi N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Injection sits in the backend product-editing module, so a valid low-privileged operator session is realistically required (PR:L); network vector and low complexity remain, with full database CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Apr 24, 2026 - 19:22 NVD

9.8 (None) 9.8 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 16:00 euvd

EUVD-2025-209568

Analysis Generated

Apr 23, 2026 - 16:00 vuln.today

CVE Published

Apr 23, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.

AnalysisAI

SQL injection in JizhiCMS v2.5.4 lets attackers inject arbitrary SQL through the product editing module, exploiting unsanitized input handled by CWE-89. The flaw carries a 9.8 CVSS with total technical impact (SSVC), and publicly available exploit code exists via a shared gist, though EPSS remains very low (0.01%) and it is not on CISA KEV. Because the product editing module is a backend/administrative function, real-world abuse likely presupposes access to that interface despite the network-facing CVSS scoring.

Technical ContextAI

JizhiCMS (Cherry-toto/jizhicms) is a lightweight PHP-based content management system popular in Chinese-language deployments, typically backed by a MySQL/MariaDB database. The vulnerability is a classic CWE-89 SQL injection: user-controllable parameters passed to the product editing feature are concatenated into database queries without adequate parameterization or escaping, allowing an attacker to alter query logic. Because CMS product/catalog modules directly read and write database rows, an injection point here can be leveraged for data extraction (UNION/blind techniques) or record manipulation. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not meaningfully identify the product, so affected-component identity rests on the CVE description and the vendor's GitHub repository.

RemediationAI

No vendor-released patch or fixed version is identified at time of analysis; monitor the vendor repository and the tracking issue (https://github.com/Cherry-toto/jizhicms/issues/105) and VulDB advisory (https://vuldb.com/vuln/359157) for an official fix, and upgrade to a patched release as soon as one is published. As compensating controls until then: restrict access to the CMS administrative/product-editing backend to trusted IPs or via VPN so the injectable endpoint is not broadly reachable (trade-off: complicates legitimate remote administration); deploy a WAF with SQL-injection rulesets tuned to the product-edit request parameters (trade-off: signature-based rules can be bypassed and may false-positive on legitimate catalog content); enforce least-privilege on the database account used by JizhiCMS so a successful injection cannot escalate beyond the CMS schema (trade-off: none significant if roles are set correctly); and review web/database logs for anomalous UNION/boolean queries against product-edit endpoints. A public POC gist (https://gist.github.com/4iFei/14ad89c3b44348dd575bf5ae0ed5a19c) exists, so prioritize these controls promptly.