CVE-2025-7102

Name of the Vulnerable Software and Affected Versions: BoyunCMS versions up to 1.4.20

Description: A critical issue has been identified, affecting the file application/update/controller/Server.php. The manipulation of the phone argument leads to SQL injection. This issue can be exploited remotely.

Recommendations: For BoyunCMS versions up to 1.4.20, as a temporary workaround, consider restricting access to the Server.php file in the application/update/controller directory to minimize the risk of exploitation. Avoid using the phone argument in the affected code until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.