Tcybao

**Name of the Vulnerable Software and Affected Versions** Wuzhicms version 4.1.0 **Description** The issue allows attackers to execute arbitrary SQL commands via the `keyValue` parameter in the "/coreframe/app/pay/admin/index.php" API endpoint. This enables attackers to manipulate database queries, potentially leading to unauthorized data access or modification. **Recommendations** For Wuzhicms version 4.1.0, consider restricting access to the `/coreframe/app/pay/admin/index.php` API endpoint until a patch is available. As a temporary workaround, avoid using the `keyValue` parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wuzhi CMS version 4.1.0 **Description** An SQL injection issue exists via the `KeyValue` parameter in coreframe/app/order/admin/index.php. **Recommendations** For Wuzhi CMS version 4.1.0, consider restricting access to the `KeyValue` parameter in the affected file until a patch is available. Avoid using the `KeyValue` parameter in the vulnerable endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wuzhi CMS version 4.1.0 **Description** A SQL Injection issue exists via the `keywords` parameter under the coreframe/app/promote/admin/index.php file. This allows for potential exploitation. **Recommendations** For Wuzhi CMS version 4.1.0, consider restricting access to the `keywords` parameter in the coreframe/app/promote/admin/index.php file until a patch is available. Avoid using the `keywords` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wuzhi CMS version 4.1.0 **Description** A SQL Injection issue exists via the `keywords` parameter under the "/coreframe/app/order/admin/card.php" file. **Recommendations** For Wuzhi CMS version 4.1.0, consider restricting access to the "/coreframe/app/order/admin/card.php" file until a patch is available. As a temporary workaround, avoid using the `keywords` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.