YzmCMS CVE-2026-13529

The target must be running YzmCMS version 7.5 or earlier. The vulnerable file /application/install/index.php must be reachable over HTTP or HTTPS - this file is typically active only during initial installation and on systems where it was not removed or access-restricted post-deployment. No authentication is required per the CVSS 4.0 PR:N metric. Exploitation is limited by high attack complexity (AC:H), which the description characterizes as 'difficult' - the attacker must construct a valid SQL injection payload suitable for the specific query in the install handler, and the endpoint must be discoverable. Systems that have deleted or web-server-blocked the install directory after setup are not exploitable. There is no indication the vulnerability requires a specific database backend, but YzmCMS typically runs on MySQL, which is the most common target for PHP-CMS SQL injection.

The CVSS 4.0 base score of 6.3 reflects a network-reachable vector (AV:N) with no authentication required (PR:N) and no user interaction (UI:N), but critically high attack complexity (AC:H) and all-Low impact ratings (VC:L/VI:L/VA:L). The E:P modifier confirms a public proof-of-concept exists but stops short of confirmed exploitation. No CISA KEV listing means active in-the-wild exploitation is not confirmed. The real-world risk is highly conditional: the install endpoint /application/install/index.php is typically functional only during initial deployment or when left exposed post-installation - environments that correctly remove or restrict this file are not materially exposed. The public POC (GitHub) lowers the exploitation bar despite the high-complexity rating, but the limited impact ceiling (Low across CIA) constrains blast radius. No EPSS score is provided in the input data, so exploitation probability cannot be quantitatively cross-referenced. The vendor's non-response to disclosure is a notable risk amplifier as no official remediation exists.

An attacker scans for YzmCMS installations where /application/install/index.php remains publicly accessible after deployment - a common oversight on shared hosting or quickly provisioned instances. Using the publicly available proof-of-concept at https://github.com/drose025/security/blob/main/1.md, the attacker submits a crafted HTTP request with a malicious siteurl parameter containing SQL injection payloads, causing the backend query to return database contents such as admin credentials or configuration data. The high attack complexity rating likely reflects the need to precisely craft the payload to fit the query structure or work around partial input handling, but the public POC effectively automates this step.