An attacker can manipulate the siteurl argument in the application/install/index.php file of YzmCMS up to version 7.5, resulting in a SQL injection that can be performed remotely. The vulnerability enables unauthorized access to the database, potentially allowing data exfiltration, tampering, or full database compromise. The attack requires moderate effort and the exploitability is reported as difficult, but it remains publicly disclosed and may be executed without authentication.

YzmCMS content management system, all versions through 7.5. The vulnerable code resides in the installation directory; any instance exposing that directory is at risk.

The CVSS score of 6.3 indicates a medium severity. EPSS data is not available, so the likelihood of exploitation is uncertain, but the vulnerability has been disclosed publicly and can be leveraged by skilled adversaries. The attack vector is remote, requiring delivery of a crafted request to the installations script; the lack of authentication and high complexity suggest that exploitation is technically doable but may require an attacker with moderate skill.