PT-2025-53658 · Eyoucms · Eyoucms

Vuldb + 1 · Published 2025-12-28 · Updated 2025-12-30 · CVE-2025-15143

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EyouCMS versions prior to 1.7.7

Description A security flaw exists in EyouCMS up to version 1.7.6. The issue is related to a SQL injection within the Backend Template Management component, specifically in the file /application/admin/logic/FilemanagerLogic.php. Manipulation of the content argument in an unknown function within this file can lead to SQL injection. The attack can be launched remotely, and an exploit has been publicly released. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Update EyouCMS to version 1.7.7 or later. As a temporary workaround, restrict access to the file /application/admin/logic/FilemanagerLogic.php.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-15143

Affected Products

Eyoucms

References · 11

• 🔥 https://note-hxlab.wetolink.com/share/XfINjg5i25Ud · Exploit
• https://osv.dev/vulnerability/CVE-2025-15143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15143 · Security Note
• https://t.me/cveNotify/147219 · Telegram Post
• https://t.me/cveNotify/146982 · Telegram Post
• https://twitter.com/CVEnew/status/2005319940845289512 · Twitter Post
• https://vuldb.com/?submit.716078 · Note
• https://vuldb.com/?ctiid.338521 · Note
• https://t.me/CVEtracker/40779 · Telegram Post
• https://vuldb.com/?id.338521 · Note
• https://twitter.com/VulmonFeeds/status/2005314234163269741 · Twitter Post