CVE-2026-7389 - Vulnerability Details

- EyouCMS common.php GetSortData sql injection

Description

A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The manipulation of the argument sort_asc leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-04-29

Score: 6.9 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

A SQL injection flaw exists in the GetSortData function of EyouCMS, triggered by the sort_asc parameter. Attackers can craft malicious input to alter SQL statements, potentially retrieving, modifying, or deleting database content. The vulnerability can compromise data confidentiality, integrity, and availability. It is a classic injection weakness reflected in CWE-74 and CWE-89.

Affected Systems

The affected product is EyouCMS up to version 1.7.9. The vulnerability resides in the application/common.php file of the CMS, so any installation running a vulnerable version and exposing the GetSortData functionality is at risk. No other vendors or products are listed.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is unavailable, so the estimated exploitation probability cannot be quantified, but the vulnerability is publicly disclosed. It is not currently listed in the CISA KEV catalog. The attack vector is remote, with the function potentially exposed over the internet, and no special local privilege or credentials are required. Exploit conditions are minimal, making the risk relatively high for exposed installations.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

EyouCMS

affected

Version	Status	Constraints
`1.7.0`	affected	—
`1.7.1`	affected	—
`1.7.2`	affected	—
`1.7.3`	affected	—
`1.7.4`	affected	—
`1.7.5`	affected	—
`1.7.6`	affected	—
`1.7.7`	affected	—
`1.7.8`	affected	—
`1.7.9`	affected	—

No data.

Vendor Product Confidence Versions

Eyoucms

95%

Version	Status	Scheme	Platform
`1.7.0`	affected	semver	—
`1.7.1`	affected	semver	—
`1.7.2`	affected	semver	—
`1.7.3`	affected	semver	—
`1.7.4`	affected	semver	—
`1.7.5`	affected	semver	—
`1.7.6`	affected	semver	—
`1.7.7`	affected	semver	—
`1.7.8`	affected	semver	—
`1.7.9`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest EyouCMS release that removes the vulnerable code or backport the fix to your current version if an update is not available. This is the definitive remedy for the injection flaw.
If an immediate update is not possible, restrict external access to the GetSortData endpoint by configuring firewalls or web application gateway rules to allow requests only from trusted IP ranges.
Implement input validation or parameterized queries for sort_asc values to prevent semicolons or SQL control characters from being processed by the database. This mitigates the injection risk even if the underlying code remains unchanged.

Generated by OpenCVE AI on April 30, 2026 at 03:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

No EPSS score available.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://gitee.com/weng_xianhu/eyoucms/issues/IILFPE
https://vuldb.com/submit/803103
https://vuldb.com/vuln/360114
https://vuldb.com/vuln/360114/cti

History

Wed, 29 Apr 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 29 Apr 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The manipulation of the argument sort_asc leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title		EyouCMS common.php GetSortData sql injection
First Time appeared		Eyoucms Eyoucms eyoucms
Weaknesses		CWE-74 CWE-89
CPEs		cpe:2.3:a:eyoucms:eyoucms::::::::
Vendors & Products		Eyoucms Eyoucms eyoucms
References		https://gitee.com/weng_xianhu/eyoucms/issues/IILFPE https://vuldb.com/submit/803103 https://vuldb.com/vuln/360114 https://vuldb.com/vuln/360114/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Eyoucms Eyoucms

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-04-29T15:30:18.641Z

Updated: 2026-04-29T16:19:40.411Z

Reserved: 2026-04-29T09:35:05.397Z

Link: CVE-2026-7389

Vulnrichment

Updated: 2026-04-29T16:19:36.611Z

NVD

Status : Deferred

Published: 2026-04-29T16:16:29.690

Modified: 2026-04-29T21:16:21.590

Link: CVE-2026-7389

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-30T04:00:15Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object