EyouCMS versions up to 1.7.9 are vulnerable to a remote SQL injection attack that allows unauthenticated adversaries to manipulate database queries.

The vulnerability is a SQL injection flaw (CWE-89) located in the GetSortData function of application/common.php. An unauthenticated remote attacker can supply malicious input to the sort_asc parameter to compromise database integrity.

A successful exploit allows an attacker to perform unauthorized database operations, which could lead to data exfiltration, modification, or the bypassing of application security controls. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to the confidentiality and integrity of the underlying system, particularly if the database contains sensitive user or configuration data.

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict access to the affected application or implement input validation rules to sanitize the sort_asc parameter.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing SQL syntax or unusual characters directed at the application/common.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, specifically targeting the sort_asc parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the issue report at the Gitee repository.

Given the public availability of exploit details and the lack of a vendor-provided patch, this vulnerability presents a serious security risk. Organizations utilizing EyouCMS versions 1.7.9 and below must prioritize implementing compensating controls, such as WAF rules, and restrict network access to the installation until an official security update is released and verified.