Muucmf EUVD-2026-23688

Remote network access to the muucmf installation's /index/Search/index.html endpoint, which is typically exposed by default as part of the public-facing search functionality in standard muucmf deployments. No authentication, special user roles, or non-default configuration settings are required - the CVSS vector confirms PR:N (no privileges needed) and UI:N (no user interaction). Exploitation is limited only by network reachability; if the search endpoint is accessible to untrusted networks (internet-facing or internal network segments containing potential attackers), the vulnerability is exploitable. The low attack complexity (AC:L) indicates no race conditions, complex timing requirements, or unusual environmental factors constrain successful exploitation. Organizations that have restricted access to the search module through IP allowlisting, VPN-only access, or complete endpoint disablement are protected, but such configurations are non-standard for a CMS search feature.

This vulnerability presents elevated real-world risk despite the absence of CISA KEV listing. The CVSS 7.3 score reflects substantial impact across confidentiality, integrity, and availability (C:L/I:L/A:L), with critical accessibility factors: network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The CVSS temporal metrics show proof-of-concept code exists (E:P), remediation level unavailable (RL:X), and confirmed report (RC:R). Most significantly, a detailed public exploit is available at thinhneee.github.io/posts/muucmf-sqli/, dramatically lowering the barrier to exploitation. The vendor's non-responsiveness to coordinated disclosure raises serious concerns about patch availability and ongoing support. However, real-world risk is somewhat contained by the limited deployment footprint of muucmf compared to mainstream CMS platforms like WordPress or Drupal. Organizations using this framework face immediate risk and should treat this as a priority, while the broader community exposure remains limited. The combination of public exploit, unauthenticated remote access, and vendor silence creates a high-risk scenario for affected deployments, despite the absence of confirmed widespread exploitation.

An external attacker identifies a muucmf installation through version fingerprinting or search engine reconnaissance. Using the publicly available exploit code from thinhneee.github.io, the attacker crafts a malicious HTTP GET or POST request to /index/Search/index.html with a SQL injection payload in the 'keyword' parameter (e.g., keyword=' UNION SELECT username,password,email FROM admin_users--). The vulnerable getListByPage function concatenates this unsanitized input directly into a SQL query, executing the attacker's injected commands. The attacker extracts administrative credentials, modifies database content to inject persistent backdoors or defacement, or executes stored procedures to achieve database server command execution if the database user has elevated privileges.