The flaw resides in jizhiCMS’s Model.php within the Batch interface, where improper handling of the findAll method allows an attacker to inject arbitrary SQL statements. This vulnerability matches CWE-74 and CWE-89. The attack can be carried out remotely by supplying crafted input data, potentially enabling the attacker to read, alter, or delete database content. This unauthorized data exposure or compromise could undermine sensitive user information and the integrity of the application’s data layer.

The vulnerability affects installations of jizhiCMS with versions 2.5.6 or earlier. Versions beyond 2.5.6 are not listed as affected in the available information.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The flaw is not included in CISA’s KEV catalog, and evidence suggests the attacker must interact with the web application remotely, exploiting the insufficiently sanitized input to the findAll function. Although the probability is low, the potential impact on confidentiality and integrity warrants monitoring and review.