References https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/YzmCMS/YzmCMS%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8pay_callback%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C.md https://cn-sec.com/archives/2703886.html https://www.ddpoc.com/DVB-2024-6994.html https://xsx.tw/exploit/3624/ https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/YzmCMS/YzmCMS%20v3.6%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/ https://blog.csdn.net/hadoop5ranger/article/details/155304805 https://blog.csdn.net/shelter1234567/article/details/138524342 https://www.fxbaogao.com/detail/4365373 https://blog.csdn.net/lv_yong/article/details/104734482 https://www.anquanke.com/post/id/229611
Related VulnerabilitiesSEMCMS /index.php SQL 注入漏洞(CVE-2023-48864)PoCCVE-2018-7653: YzmCMS v3.6 - Cross-Site ScriptingPoCCVE-2020-29597: IncomCMS 2.0 - Arbitrary File UploadPoCCVE-2022-23898: MCMS 5.2.5 - SQL InjectionPoCCVE-2022-25125: MCMS 5.2.4 - SQL InjectionPoCCVE-2022-26585: Mingsoft MCMS v5.2.7 - SQL InjectionPoCCVE-2022-4375: Mingsoft MCMS - SQL InjectionPoCCVE-2023-3990: Mingsoft MCMS < 5.3.1 - Cross-Site ScriptingPoCCVE-2022-23898: MCMS IContentDao.xml. v5.2.5 - SQL InjectionPoCCVE-2022-25125: MCMS 5.2.4 - SQL InjectionPoCCVE-2023-50578: Mingsoft MCMS 5.2.9 - SQL InjectionPoCyzmcms-installer: YzmCMS - Installer