EUVD-2026-26252Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, unauthenticated SQL injection with no user interaction or scope change; partial impact across all three pillars consistent with CWE-74 partial injection.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The manipulation of the argument sort_asc leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
SQL injection in EyouCMS versions 1.7.0 through 1.7.9 allows remote unauthenticated attackers to manipulate database queries by passing malicious input via the sort_asc argument to the GetSortData function in application/common.php. A public proof-of-concept has been disclosed on Gitee, and SSVC classifies the attack as automatable with partial technical impact, though EPSS remains very low at 0.03% (8th percentile), indicating limited observed mass exploitation. No vendor patch exists - the project was notified via responsible disclosure but has not responded, leaving all 1.7.x deployments exposed.
Technical ContextAI
EyouCMS is a PHP-based content management system targeting the Chinese-language web market. The vulnerability exists in the GetSortData function within application/common.php, where the sort_asc parameter is incorporated into a database query without proper sanitization or parameterized query binding. This falls under CWE-74 (Injection), a root cause class where user-controlled input is not neutralized before being passed to a downstream interpreter - in this case, the SQL database engine. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the function is reachable over the network without authentication and requires no special attack prerequisites. All versions in the 1.7.x branch (1.7.0 through 1.7.9) are affected per ENISA EUVD-2026-26252.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was notified via responsible disclosure on Gitee (https://gitee.com/weng_xianhu/eyoucms/issues/IILFPE) but has not responded. As the primary compensating control, deploy a web application firewall rule that strictly allowlists the sort_asc parameter to expected values only (e.g., the literal strings 'asc' or 'desc'), rejecting any other input; this carries negligible functional impact since sort direction is binary. Additionally, configure the database account used by EyouCMS with the minimum required privileges - ideally read-only for front-end query paths - to limit the blast radius of a successful injection to data exfiltration rather than data modification. Organizations should monitor the Gitee issue tracker and VulDB (https://vuldb.com/vuln/360114) for patch availability and apply any released fix immediately upon publication.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today