The vulnerability is a SQL injection in YzmCMS 7.5’s get_arrchildid() function, where the parentid parameter is concatenated directly into a FIND_IN_SET SQL clause without any sanitization. An authenticated administrator can supply crafted input that triggers a boolean‑based blind injection, allowing execution of arbitrary SQL statements. This can lead to full compromise of the database, exposing all stored data and potentially enabling further lateral movement within the system.

YzmCMS 7.5

A breach requires an authenticated administrator account; the exploit path involves sending a malicious request to the vulnerable category controller. No public exploit or CVSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The lack of an EPSS score indicates insufficient data on current exploitation probability, but the potential impact remains high because an attacker gaining admin privileges can obtain unrestricted database access.