A SQL injection flaw exists in the query parameters of Yot CMS 3.3.1 that lets any user send specially crafted GET requests containing malicious code in the aid or cid fields. These requests are passed directly to the database engine, enabling the execution of arbitrary SQL statements. The impact is the ability to read, modify, or delete data in the underlying database, including table and column names, user credentials, and application configuration values.

Yot CMS version 3.3.1 is affected. No other versions are mentioned as vulnerable, so only installations running this exact version are at risk.

The CVSS score of 8.8 classifies this issue as high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an unauthenticated attacker only needs to send a crafted HTTP GET request to index.php with malicious payloads in aid or cid. No prior authentication or escalation is required, making exploitation straightforward for a web attacker.