The vulnerability is a SQL injection in YzmCMS 7.5’s get_arrchildid() function, where the parentid parameter is concatenated directly into a FIND_IN_SET SQL clause without any sanitization. An authenticated administrator can supply crafted input that triggers a boolean‑based blind injection, allowing execution of arbitrary SQL statements. This can lead to full compromise of the database, exposing all stored data and potentially enabling further lateral movement within the system.

YzmCMS 7.5

A breach requires an authenticated administrator account; the exploit path involves sending a malicious request to the vulnerable category controller. The vulnerability carries a CVSS v3.1 score of 7.2 and is not listed in CISA’s KEV catalog. The EPSS score is < 1%, indicating a low exploitation probability currently, but the potential impact remains high because an attacker with admin privileges can execute arbitrary SQL and compromise the database.