Cpe:2.3:a:yot:cms:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ayotcms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 14 Sep 2026 11:33:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in Yot CMS Cookie Handlerhttps://feed.craftedsignal.io/briefs/2026-09-yot-cms-sqli/Mon, 14 Sep 2026 11:33:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-yot-cms-sqli/An unauthenticated remote SQL injection vulnerability in Yot CMS versions up to 3.3.1 allows attackers to execute arbitrary database commands via the Login function.Yot CMS versions up to 3.3.1 are vulnerable to a SQL injection vulnerability (CVE-2026-90708) located in the Login function within the global.php file of the Cookie Handler component. The vulnerability arises from improper sanitization of the yot3_user and yot3_pass arguments. Attackers can trigger this vulnerability remotely by sending malicious HTTP requests containing SQL injection payloads to the application. Public exploit code for this vulnerability is available, increasing the risk of exploitation. Defenders should treat this as a high-priority risk for internet-facing installations of Yot CMS and consider implementation of input validation controls or upgrading the software if a patch is available.

Attack Chain

  1. Attacker performs reconnaissance to identify internet-facing Yot CMS instances.
  2. Attacker locates the application login page or cookie handling logic.
  3. Attacker crafts an HTTP request targeting the Login function in global.php.
  4. Attacker inserts malicious SQL syntax into the yot3_user or yot3_pass cookie arguments.
  5. The server-side application fails to sanitize these inputs and passes them to the database query.
  6. The database executes the injected SQL commands, potentially leading to unauthorized data access, credential theft, or bypass of authentication.

Impact

Successful exploitation of this vulnerability allows unauthorized access to the backend database. This may lead to the exfiltration of sensitive information, including user credentials or session data, and in some configurations, could result in administrative account compromise or complete control over the CMS instance.

Recommendation

  1. Identify all instances of Yot CMS (<= 3.3.1) in your environment.
  2. Implement a Web Application Firewall (WAF) rule to inspect and block HTTP requests containing SQL injection patterns directed at the Login function or global.php.
  3. Monitor web server logs for anomalies in the 'yot3_user' or 'yot3_pass' parameters.
  4. Coordinate with IT operations to patch or upgrade Yot CMS to a version beyond 3.3.1.
]]>highadvisory