CVE-2025-15143
SQL Injection in EyouCMS Backend Template Management Allows Remote Exploit
Publication date: 2025-12-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| eyoucms | eyoucms | 1.7.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a security flaw in EyouCMS up to version 1.7.6, specifically in an unknown function within the file /application/admin/logic/FilemanagerLogic.php related to Backend Template Management. It allows an attacker to manipulate the 'content' argument to perform an SQL injection attack remotely.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable file `/application/admin/logic/FilemanagerLogic.php` in EyouCMS versions up to 1.7.6. Additionally, administrators can look for suspicious template files containing `{eyou:sql}` tags that execute arbitrary SQL queries, especially those using MySQL's INTO OUTFILE feature to write files to the webroot. A suggested method includes searching for the vulnerable file via web server directories or using Google dorking with the query `inurl:application/admin/logic/FilemanagerLogic.php` to identify exposed instances. Monitoring for unusual template files like `poc_shell.htm` or unexpected `{eyou:include}` directives in main templates (e.g., `index.htm`) may also help detect exploitation attempts. Specific commands might include: 1) Using find or grep on the server to locate template files with `{eyou:sql}` tags, e.g., `grep -r '{eyou:sql}' /path/to/eyoucms/templates/`; 2) Using Google dorking externally with `inurl:application/admin/logic/FilemanagerLogic.php` to find vulnerable installations. Note that exploitation requires authenticated administrator access, so monitoring admin login activity and template changes is also recommended. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling administrator access to the backend template management system until a patch or fix is available. Since the vendor has not responded and no official patch exists, it is recommended to replace or upgrade the affected component to a non-vulnerable version or alternative product. Administrators should audit and remove any suspicious template files that contain `{eyou:sql}` tags or unauthorized includes. Additionally, monitoring and restricting the use of template tags that allow SQL execution, especially `{eyou:sql}`, can reduce risk. Applying strict input validation and limiting permissions of the database user to prevent file writes via INTO OUTFILE can also help mitigate exploitation. Finally, monitoring logs for unusual template modifications or webshell access attempts is advised. [3]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access or manipulation of the database through SQL injection, potentially compromising data confidentiality, integrity, and availability. Since the attack can be launched remotely, it poses a significant risk to systems using the affected EyouCMS versions.