CVE-2026-6978 Details

A SQL injection vulnerability has been identified in JiZhiCMS versions through 2.5.6. The issue arises in the addcache.html file within the admin Sys directory, where user input is decoded using the htmlspecialchars_decode function. This decoded input is then directly appended to SQL queries, creating an opportunity for SQL injection attacks. The vulnerability can be exploited remotely, and a public exploit is available.

It is recommended to use prepared statements for database queries to prevent SQL injection vulnerabilities. The vulnerable code can be replaced with a version that uses prepared statements, ensuring that user input is properly sanitized and not directly concatenated into SQL queries.