CVE-2026-7389: EyouCMS SQL Injection Vulnerability Exposed

The National Vulnerability Database has disclosed CVE-2026-7389, a high-severity SQL injection vulnerability impacting EyouCMS versions up to 1.7.9. The flaw resides within the GetSortData function of the application/common.php file, specifically through the manipulation of the sort_asc argument. This vulnerability allows for remote exploitation, presenting a clear path for attackers to gain unauthorized access to database information.

The CVSSv3.1 score of 7.3 (HIGH) underscores the significant risk, with the attack vector being network-based, low complexity, and requiring no privileges or user interaction. This means any unauthenticated attacker can exploit it directly over the network. The exploit code has been publicly disclosed, which dramatically increases the immediate threat level. The National Vulnerability Database indicates that EyouCMS was informed of the issue but has not yet responded or released a patch.

For defenders, this is a critical situation. Unpatched EyouCMS installations are now exposed to active exploitation given the public disclosure. Attackers will quickly integrate this into their toolkits. The primary concern is data exfiltration and potential compromise of the entire web application, as SQL injection is a gateway to further attacks.