SQL Injection Vulnerability in WuzhiCMS

A SQL injection vulnerability has been identified in WuzhiCMS in versions up to and including 4.1.0. The vulnerability resides within the article::getDataOfJson function, which is reachable via the endpoint /index.php?m=content&f=article&v=getDataOfJson. By manipulating the 'title' or 'master_table' arguments within an HTTP request, an unauthenticated remote attacker can inject arbitrary SQL commands. This flaw allows for potential unauthorized database access, including data exfiltration, modification, or deletion, depending on the privileges of the database user configured for the CMS. As of the disclosure date, the vulnerability is publicly documented with an available exploit, and the vendor has not yet addressed the issue. Organizations running affected WuzhiCMS instances should implement web application firewalls or similar controls to inspect incoming requests for SQL injection patterns targeting the specified endpoint.

Impact

Successful exploitation of CVE-2026-91848 allows remote, unauthenticated attackers to perform SQL injection. This can lead to complete compromise of the WuzhiCMS database, including the theft of sensitive user credentials, content, or system configuration data. The impact is significant for organizations relying on WuzhiCMS as it provides a direct vector for data exfiltration or potential persistence within the application layer.

Recommendation

• Deploy web application firewall (WAF) rules to inspect and filter incoming HTTP POST/GET requests to /index.php where the query parameters 'm=content', 'f=article', and 'v=getDataOfJson' are present, specifically monitoring the 'title' and 'master_table' fields for SQL injection payloads.
• Monitor web server logs for suspicious requests containing SQL keywords (e.g., SELECT, UNION, SLEEP, FROM) within the defined vulnerable parameters.
• If feasible, restrict access to the /index.php?m=content&f=article&v=getDataOfJson endpoint at the network or web server level until a patch is released by the vendor.
• Audit database user privileges used by the WuzhiCMS application to follow the principle of least privilege, limiting the potential impact of a successful injection attack.