CVE-2026-13529: YzmCMS SQL Injection Vulnerability Analysis & Remediation

Technical summary

The vulnerability exists in /application/install/index.php where insufficient input sanitization on the siteurl argument permits SQL injection attacks. The flaw is classified under CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (SQL Injection). Exploitation requires high attack complexity—specifically overcoming environmental or technical constraints that limit practical real-world impact. The CVSS 3.1 score of 5.6 (MEDIUM) reflects limited confidentiality and integrity impact with no availability compromise.

Business impact

Organizations running YzmCMS up to version 7.5 face risk of unauthorized database access and potential data modification if the installation interface remains exposed. The impact is primarily informational—attackers could extract sensitive data—rather than service-disrupting. However, if combined with other weaknesses or deployed in environments where the install directory is left publicly accessible post-deployment, the risk escalates. The lack of vendor response complicates patch planning.

Affected systems

YzmCMS versions through 7.5 are affected. The vulnerability specifically targets the installation component, meaning active risk is highest for instances where /application/install/index.php remains accessible after initial setup. No other vendors or products are identified as affected.

Exploitability

Public disclosure has occurred, but the attack carries high complexity requirements that substantially limit exploitation likelihood. An attacker would need to craft a malicious siteurl payload and successfully execute it against the installation script—a scenario most relevant if the install directory has not been removed or secured post-deployment. The difficulty rating, combined with the high attack complexity, means this is not a trivial vulnerability to weaponize despite public details being available.

Remediation

Immediately verify that /application/install/index.php is not accessible in production environments—this is a standard hardening practice post-installation. Monitor your YzmCMS installation version and watch for community patches or alternative vendor contact channels. If you operate YzmCMS 7.5 or earlier and the install directory is still exposed, restrict access via web server configuration (e.g., .htaccess or web server rules) until a patch is available or you can upgrade.

Patch guidance

No official patch from the vendor is currently available. Check YzmCMS community forums, GitHub repositories, or security advisories for any community-developed patches. Verify any patch version against the official YzmCMS release notes before applying. If using YzmCMS, prioritize moving to the next major release once available and validated.

Detection guidance

Monitor web server logs for unusual requests to /application/install/index.php after your initial deployment—legitimate traffic to this path should be near-zero in production. Look for requests containing SQL metacharacters or encoded variants in the siteurl parameter. Web application firewalls (WAF) rules targeting SQL injection patterns in GET/POST parameters can provide defensive detection. Database activity monitoring for anomalous queries originating from the web application layer may also surface exploitation attempts.

Why prioritize this

This vulnerability merits attention but not emergency response for most organizations. The MEDIUM severity and high attack complexity lower urgency, but the lack of vendor responsiveness and public exploit disclosure warrant timely mitigation. Priority increases sharply if your YzmCMS installation still has an exposed install directory—that configuration choice transforms a difficult exploit into a realistic risk.

Risk score, explained

The CVSS 3.1 score of 5.6 reflects a network-accessible vulnerability with limited exploitability due to high attack complexity (AC:H), no privilege requirement, and confidentiality and integrity impacts limited to the database. The availability impact is absent. This

Frequently asked questions