Description

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-14T11:17:07.313Z",
  "pubdate": "2026-09-14T11:17:07.313Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in Yot CMS versions up to 3.3.1. The vulnerability resides within the Cookie Handler component, specifically impacting the Login function defined in global.php. This security flaw allows unauthenticated remote attackers to inject malicious SQL commands via the yot3_user and yot3_pass arguments.\nBy manipulating these input parameters, an adversary can bypass authentication mechanisms, gain unauthorized access to sensitive information, or potentially execute arbitrary database operations. Given that exploit code is publicly available, the risk of exploitation is significantly elevated. The vulnerability facilitates unauthorized data exfiltration and complete compromise of the underlying database, necessitating immediate attention to secure the affected infrastructure.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in the Cookie Handler component of Yot CMS, specifically within the Login function in global.php. The root cause is the improper sanitization and validation of user-supplied data transmitted via the yot3_user and yot3_pass cookie arguments. When the application processes these cookies to verify user identity, the values are concatenated directly into SQL query strings executed against the backend database without sufficient parameterization or escaping.\nThe attack flow begins with a remote adversary crafting HTTP requests containing specially formatted cookie headers. By injecting SQL syntax (e.g., using UNION-based techniques or boolean-based inference) into the yot3_user or yot3_pass fields, the attacker forces the database to interpret the injected input as part of the intended SQL command structure. Because these arguments are processed by the global.php file during the authentication handshake, the injection occurs before the application logic determines the validity of the user credentials.\nExploitation does not require prior authentication or elevated privileges, making it accessible to any remote actor capable of reaching the application via the network. By manipulating the query logic, an attacker can effectively bypass the intended authentication checks, allowing for unauthorized access to administrative functions or private user accounts. Furthermore, the vulnerability allows for the extraction of the entire database schema and its contents through techniques such as blind SQL injection, where the attacker observes differences in HTTP response codes, content length, or execution time to infer database contents bit by bit.\nThe impact is critical, as it compromises the confidentiality and integrity of the entire database managed by Yot CMS. Potential post-exploitation activities include the dumping of user credentials, personal data, or session information. Since the exploit is publicly available, the barrier to entry for attackers is extremely low, allowing even unsophisticated actors to leverage these primitives to compromise installations of Yot CMS versions up to 3.3.1."
}