A flaw exists in JiZhiCMS versions up to 2.5.6 within the htmlspecialchars_decode function in /index.php/admins/Sys/addcache.html, where the sqls argument is not properly sanitized, enabling the injection of arbitrary SQL statements. This leads to execution of malicious database commands, allowing an attacker to retrieve, modify, or delete data, thereby compromising database confidentiality, integrity, and availability. The attack does not depend on any session state or CSRF token, enabling it to be triggered by a simple HTTP request to the vulnerable endpoint.

All JiZhiCMS installations running any release version through 2.5.6 are potentially affected. The vulnerable code resides in the addcache.html subsystem of the administrative interface. No other vendors or product versions are listed in the CNA data.

The CVSS score of 5.1 indicates medium severity, while the EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not catalogued in the CISA KEV list. Because the flaw is remotely exploitable via the sqls parameter and a public exploit exists, an attacker could gain unauthorized database access if the compromised CMS instance is exposed to the internet and proper access controls are not in place.