Yot CMS 3.3.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through…

CVE-2018-25425 affects Yot CMS version 3.3.1, containing an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries. The vulnerability exists in the aid and cid parameters of index.php. Attackers can exploit this by sending crafted GET requests with malicious SQL payloads through these parameters. The vulnerability allows extraction of sensitive database information including table and column names. This represents a critical security flaw as it requires no authentication and provides direct database access to attackers.