Description

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/master_table leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-15T16:17:42.817Z",
  "pubdate": "2026-09-15T16:17:42.817Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in WuzhiCMS versions up to 4.1.0, specifically within the article::getDataOfJson function.\nThe vulnerability allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL statements through the 'title' or 'master_table' parameters.\nSuccessful exploitation grants an attacker the ability to bypass authentication, exfiltrate sensitive data from the underlying database, modify database content, or execute administrative operations.\nThis vulnerability poses a significant risk to the integrity, confidentiality, and availability of the affected system.\nThe attack is remotely exploitable, and the availability of public exploit code increases the likelihood of active exploitation. No vendor response or official patch has been confirmed, necessitating immediate defensive measures by administrators.",
  "technicalDetails": "The vulnerability is located in the file /index.php, specifically triggered when the controller and action parameters are set to m=content, f=article, and v=getDataOfJson. The root cause of this flaw is improper input validation and insufficient sanitization of user-supplied data passed to the 'title' and 'master_table' arguments.\nWithin the article::getDataOfJson function, these parameters are directly concatenated into a SQL query executed against the backend database. By failing to utilize parameterized queries or prepared statements, the application creates a primary vector for SQL injection.\nThe attack flow commences when a remote attacker sends a crafted HTTP request to the vulnerable endpoint. By injecting malicious SQL syntax into the 'title' or 'master_table' parameters, the attacker can manipulate the structure of the resulting SQL command. For example, an attacker can use UNION-based injection to append unauthorized SELECT statements to the original query, thereby retrieving data from arbitrary tables.\nFurthermore, the vulnerability may facilitate Blind SQL injection, allowing an attacker to infer data character-by-character based on the application's response behavior. Because the application does not implement adequate access controls for this function, the attack can be executed without prior authentication.\nThe exploitation process typically involves: 1) Identification of the vulnerable endpoint via the index.php URL parameters; 2) Testing the 'title' and 'master_table' inputs with standard SQL injection payloads (e.g., using sleep() or benchmark() functions to confirm vulnerability); 3) Crafting a payload to extract data from system tables, user credential tables, or configuration tables; and 4) Executing the payload to exfiltrate the targeted database content.\nThe post-exploitation impact is severe. Successful execution permits full database compromise, which often leads to complete server takeover if the database user possesses excessive privileges. In many WuzhiCMS deployments, this level of access allows an attacker to extract administrator session tokens or credentials, effectively bypassing all application-level security controls.\nThis vulnerability is particularly dangerous due to its accessibility, as it requires no specialized privileges, and the publicly available exploit code significantly lowers the barrier for entry for malicious actors targeting WuzhiCMS installations."
}