A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection, potentially leading to full database compromise.

A SQL injection vulnerability has been identified in YzmCMS version 7.5, tracked as CVE-2026-75417. The vulnerability exists in the get_arrchildid() function located in application/admin/controller/category.class.php. The flaw arises from unsanitized concatenation of the user-controlled parentid parameter directly into a FIND_IN_SET() SQL clause. An authenticated administrator can exploit this vulnerability to perform boolean-based blind SQL injection attacks. Successful exploitation could allow arbitrary SQL query execution against the backend database. The potential impact includes full database compromise, including reading, modifying, or deleting sensitive data. A proof-of-concept (PoC) has been published on GitHub, increasing the risk of active exploitation. The vulnerability requires authentication, limiting the attack surface to admin-level users.