So Outside Technology Security CMS
AnQiCMS
Online Demonstration

SQL injection that can be triggered without logging in, how to go all the way to full site control

📅 October 26, 2026 👁️ 1

SQL injection that can be triggered without logging in, the level of harm is completely not on the same level as that requiring an account: it reduces the attack threshold to 'able to access this URL'.A set of core vulnerabilities in WordPress (CVE-2026-60137 and CVE-2026-63030, affecting versions 6.8 to 7.0.1, fixed in 7.0.2 released on July 17, 2026) could lead from reading data to full site takeover because three conditions were met simultaneously - the public entry could accept parameters, the parameters were concatenated into the query string, and the write position could be executed.The security vendor independently verified the combination of these two vulnerabilities, concluding that it includes full-site takeovers with remote code execution.

What does an unauthenticated entry mean

The entry points without authentication are usually list pages, search pages, subscription forms, and public interfaces. They must be open to visitors to ensure that they are indexed by search engines and remain accessible, and parameter validation is often considered a secondary matter. The most direct way to determine if you have such surfaces is to list the background functions that allow anonymous access, and then look at the parameters each function accepts: sorting fields, pagination, keywords, category identifiers, and time ranges are common injection points.

Low threshold brings another consequence: exploitation is batched. After the announcement is released, the scanning script will start to compare the version features across the entire network within a few hours, and by the time the webmaster sees the news, the exposed surface has already been named.

The three paths from splicing to writing files

Stage What does the attacker get? The positions lost on the site side
reading Table structure, account hash, configuration items The query statement is controlled by parameters, and can return unexpected data
Privilege escalation Backend session or direct writing capability The read credentials can be reused, or the authentication logic is bypassed
Landing Execute code on the server Writeable directory is not tightened, uploading and template editing are not restricted

The first paragraph is just a query issue, the third paragraph is already a file system design issue. The three paragraphs are connected by two bridges, 'credentials reusable' and 'directory writable', and if either is removed, the path is broken.

Why are similar injection points difficult to prevent: sorting and filtering parameters

The sorting parameter is a typical 'harmless-looking' position: it comes from the URL, ultimately拼进 ORDER BY clause. String comparison filters are prone to missing the concatenation of numbers and identifiers, whitelist validation is the verifiable approach - list the allowed sorting fields as a set, and if the value in the request is not in the set, default fields should be used instead of trying to escape and allow it.AnQiCMS has fixed the SQL injection issue in the list sorting parameter in v3.6.6 (2026-10-08), and at the same time, the issue of the login credentials being forgeable when switching sites has also been repaired;Upgrade recommendations require the rotation of site signature keys and the modification of the administrator's password to invalidate old credentials. These two combinations target similar paths: control queries first, then reuse credentials.

Convergence at the framework layer is also important. AnQiCMS uses JWT for authentication, built-in content sensitive word filtering and anti-collection interference code, blocking common input and output issues of SQL injection and XSS at the framework layer, so webmasters do not need to install extensions for basic protection.

patch before and after self-check actions

Before the patch, prioritize actions based on effectiveness: first narrow the exposed surface (close unnecessary public list interfaces, add reCAPTCHA to prevent batch submissions on public forms); then tighten write permissions (template editing permissions are only left for necessary accounts, writable directory permissions are revoked); then stabilize evidence (backup the database and static files, export access logs).

These actions are all about reducing harm, the version is the basis for determining whether it is affected. After obtaining the patch, proceed in order: first backup, then upgrade and verify the critical path on the test site, and finally move to production.

rollback and evidence preservation

The most easily lost in event handling is the timeline. Before taking action, leave three things: recoverable backup points, access logs containing parameter samples, and the current version and configuration snapshot. AnQiCMS's backup and recovery cover data and static files, and there is a fallback position after configuration tightening or misoperation. High-risk operations at the site level are set according to the domain to expose the scope, and capabilities such as backup, upgrade, and multi-site are turned off by default (DefaultOff), even if the control plane credentials are reused, the actions that the attacker can take are also limited to the range you explicitly enable.

Common questions

Does read-only injection not affect security?The read-only stage can obtain account hash and configuration items, subsequent privilege escalation and writing depend on it, and the absence of write operations in the logs does not mean they have not been read.

Do I need to upgrade the version after installing the Web Application Firewall?Yes. The firewall can block targeted requests, with a low cost of circumvention, whether affected by this vulnerability is determined only by the version range.

How to confirm that the sorting parameter is safe?Use a sorting value not on the allowed list to request the list page and see if it defaults to the default sorting instead of returning an error or abnormal data; check the background version number again after upgrading to the fixed version.

Related articles

How should the runtime dependency ledger be built on the same announcement where PHP and Node.js released urgent updates on the same day?

An announcement provides urgent patch versions for both PHP and Node.js at the same time, indicating that the runtime is an independent patch surface. The ledger only needs four columns: what version is installed, who maintains it, how to determine the patch window, and where the rollback point is. This article provides the method for creating the table and explains which line is missing in the Go language stack site on this table and how to send alerts to people through email reminders.

2026-10-26

The website itself was not hacked, but the server control panel could be attacked by a regular account to the highest privileges, let's see which layer first.

The website has not been hacked does not mean the server is secure: The permission radius of the control panel is much larger than that of a single site. The CVE-2026-65643 of cPanel shows that a person with a normal account can execute arbitrary code with root privileges after logging in. The troubleshooting sequence should first look at the account and permission groups, then look at the default switches for high-risk operations at the site level, and finally confirm the backup rollback path.

2026-10-26

The server panel has made PHP risks into a one-click reinforcement on the homepage, and there are several places in the announcement that need to be confirmed by yourself.

The home page one-click reinforcement on the panel announcement is a mitigation action: it consolidates version switching, firewall, and reinforcement items into one click, but does not confirm three things for you - whether the running version has really switched to the fix branch, whether the backup can be rolled back, and whether there are still injections and cross-site entry points on the program side. This article breaks down the positions that need to be checked according to the announcement items.

2026-10-26

In the annual report of one million AI reference samples, the position of the official website being cited depends on what

The statistics of the million-level reference samples across multiple generative engines are the distribution of sources and the number of citations, not equal to the clicks on this site. In the report, the community platform takes about 52.5% of the citations, and the brand domain name takes about 47.5%. The three points that the official website can change are: the ability to independently extract answer sections, anchor text and internal link consistency, and the stability of the sitemap and 301 maintained address.

2026-10-26

Writing parameters to the update log causes code execution by reflection into the cache page, how is this chain formed?

The parameter reflection writes into the cache page causing code execution, which requires three conditions to be met simultaneously: the request parameters are echoed exactly, the echoed content is written into the static cache, and the cache page is parsed and executed again by the server. The update log V3.2.14 of PbootCMS fixes this kind of problem. This article analyzes the chain and explains where content filtering, review, and output encoding are intercepted at each link.

2026-10-26

The publishing process of local Markdown and build commands, where will non-technical colleagues get stuck?

Locally, in the route of Markdown and build command, non-technical colleagues often get stuck at the two steps of environment and command: installing runtime, pulling repositories, executing builds, and then uploading the output products. The route with background replaces the release action with browser editing, at the cost of maintaining the runtime environment and database. Choosing based on who edits the content is more reliable than comparing feature tables.

2026-10-26

When there is no unified AI source monitoring standard, which columns should the site-side record table record?

Each generative engine has different source statistics, and what the site side needs is not another set of ratings, but a record table that can be reviewed: the original question, the cited page, the location of appearance, the natural search results for comparison, and the publication status of this version of the content. The keyword library provides a set of questions, and the site map and llms.txt provide a list of content that can be crawled. Only when all five columns are aligned can it be determined whether the change comes from the content or the source.

2026-10-26

Why is it more important to use the self-contained writing style when searching for content by segment comparison?

When searching for content by segment comparison, the page is divided into sections to participate in matching, and the logic of the entire page ranking is no longer directly applicable: a section must be able to stand independently of the context in order to be quoted. Self-contained content requires a title as a question and conclusions and conditions within the paragraph. AnQiCMS uses custom fields to keep conditions in the text, and TDK with automatic tag management to manage the retrieval entry.

2026-10-26