So Outside Technology Security CMS
AnQiCMS
Online Demonstration

Writing parameters to the update log causes code execution by reflection into the cache page, how is this chain formed?

📅 October 26, 2026 👁️ 1

The log update parameter is reflected and written into the cache page, causing code execution. This chain needs three steps: the parameters in the request are echoed exactly on the page, the echoed content is written into a static cache file, and the cache file is read again and parsed as executable syntax when read.PbootCMS official update log in V3.2.14 (2026-06-15) fixes this kind of problem - the page parameter is reflected by the spider tag and written into the HTML cache, causing PHP code to execute.To look at 'reflection' is just cross-site scripting, and with the two steps of 'caching to disk' and 'server-side parsing', the harm is shifted from the visitor side to the site side.

How many actions are described in a single update log

This description hides four verifiable technical facts. The parameters come from the URL query string, which is an external input; the 'spider tag' indicates that this branch is specifically for search engine crawling services, which should not have been triggered by ordinary visitors, but was exposed to the public entrance due to not distinguishing the caller; 'Reflection writing HTML cache' means that the input has left the dynamic rendering path and become a file on the disk; 'Causing PHP code execution' means that the cache file is parsed as a script rather than pure static resources.

The general solution to similar problems can also be found in the previous version: V3.2.13 (2026-06-06) strengthened ORM parameter binding. The two versions together form a common chain of upstream and downstream - upstream controls whether the input is spliced into the statement, and downstream controls whether the output is treated as code.

Why can reflection fall into the cache

The design premise of the cache system is that 'the response of the same URL can be reused.' When the page is generated for a crawler and the URL parameters are spliced into the output content, the parameters become part of the cache key: just by constructing a new parameter value, a new cache file can be generated, and the content of this file contains strings controlled by the submitter. The cache directory is usually writable, and the filename is predictable; with these two points combined, writing at this step almost does not require additional conditions.

Self-check for three features: Does there exist 'generate and save according to parameters' cache logic, is the cache file placed in a directory accessible to Web directly, and will the server parse the script suffix in the directory? If all three are 'yes', it is a combination that needs to be tightened immediately.

What happens when the cached page is read again?

If subsequent visitors or crawlers request the same cache, the server parses the file content as a script, and the control string is executed in the page context. The key step here is the parsing method rather than the content length: even if there is only a short tag in the file, as long as it is treated as code, it has an execution entry.

The defense surface is divided into three segments. The input segment performs verification and whitelist, such as pagination parameters only allowing numbers; the output segment performs encoding to keep the echoed content always within the text context; the parsing segment limits the executable location, the cache directory does not have script permissions, and the access path does not accept resolvable suffixes. Only one segment is done, and the link may still be possible.

Which link filters, audits, and encoding intercept?

The content filtering and review on the content side solves the problem of 'whether this text can appear on the site'. AnQiCMS's content security settings provide sensitive word filtering, keyword replacement, and content review, acting before data entry and going online, blocking illegal text and marketing words, and does not take on the responsibility of escaping grammatical levels.Injection and cross-site attacks go another way: AnQiCMS built-in JWT authentication, content sensitive word filtering and anti-crawling interference code, defend against SQL injection and XSS attacks at the framework level, static rules are managed centrally by the background, URL parameters are validated before rendering.Two lines together are a complete coverage, treating sensitive word filtering as a means of strengthening injection is a mismatch.

The relationship between caching and backup.

The cache file is also a content that needs to be included in the backup range. It is not in the database, but it determines the form of the page displayed to the user: if there is no backup or cleanup plan before the upgrade, and the new version renders abnormally, there will be no fallback state. AnQiCMS's backup and recovery cover data and static files, and the sequence for dealing with such issues is to first take the backup, then clear the cache, and finally upgrade; any problem at any step can be rolled back to the previous step.

Common questions

Does clearing the cache file count as a fix?It does not count. The cache clearing removes the products that have been written to disk, parameters can still be written to a new cache, and fixes at the version or code level are the termination conditions.

Why is it dangerous for the rendering branch given to the crawler?Attackers do not need to really come from a search engine, constructing a request with parameters can trigger this branch to generate a cache file.

How can you determine if your cache has an execution risk?Check if the cache directory can be accessed directly via Web, and if scripts with suffixes are allowed to be parsed. If either of these is no, the link is cut off.

Related articles

SQL injection that can be triggered without logging in, how to go all the way to full site control

The reason why the unauthenticated SQL injection can lead to full-site takeover is that three conditions are met simultaneously: the public entry can carry parameters, the parameters are spliced into the query statement, and the position where data is written can be executed. The combination of WordPress core CVE-2026-60137 and CVE-2026-63030 is of this kind. This article analyzes the chain and gives a self-check order in accordance with the sorting parameter injection repaired in AnQiCMS v3.6.6.

2026-10-26

How should the runtime dependency ledger be built on the same announcement where PHP and Node.js released urgent updates on the same day?

An announcement provides urgent patch versions for both PHP and Node.js at the same time, indicating that the runtime is an independent patch surface. The ledger only needs four columns: what version is installed, who maintains it, how to determine the patch window, and where the rollback point is. This article provides the method for creating the table and explains which line is missing in the Go language stack site on this table and how to send alerts to people through email reminders.

2026-10-26

The website itself was not hacked, but the server control panel could be attacked by a regular account to the highest privileges, let's see which layer first.

The website has not been hacked does not mean the server is secure: The permission radius of the control panel is much larger than that of a single site. The CVE-2026-65643 of cPanel shows that a person with a normal account can execute arbitrary code with root privileges after logging in. The troubleshooting sequence should first look at the account and permission groups, then look at the default switches for high-risk operations at the site level, and finally confirm the backup rollback path.

2026-10-26

The server panel has made PHP risks into a one-click reinforcement on the homepage, and there are several places in the announcement that need to be confirmed by yourself.

The home page one-click reinforcement on the panel announcement is a mitigation action: it consolidates version switching, firewall, and reinforcement items into one click, but does not confirm three things for you - whether the running version has really switched to the fix branch, whether the backup can be rolled back, and whether there are still injections and cross-site entry points on the program side. This article breaks down the positions that need to be checked according to the announcement items.

2026-10-26

The publishing process of local Markdown and build commands, where will non-technical colleagues get stuck?

Locally, in the route of Markdown and build command, non-technical colleagues often get stuck at the two steps of environment and command: installing runtime, pulling repositories, executing builds, and then uploading the output products. The route with background replaces the release action with browser editing, at the cost of maintaining the runtime environment and database. Choosing based on who edits the content is more reliable than comparing feature tables.

2026-10-26

When there is no unified AI source monitoring standard, which columns should the site-side record table record?

Each generative engine has different source statistics, and what the site side needs is not another set of ratings, but a record table that can be reviewed: the original question, the cited page, the location of appearance, the natural search results for comparison, and the publication status of this version of the content. The keyword library provides a set of questions, and the site map and llms.txt provide a list of content that can be crawled. Only when all five columns are aligned can it be determined whether the change comes from the content or the source.

2026-10-26

Why is it more important to use the self-contained writing style when searching for content by segment comparison?

When searching for content by segment comparison, the page is divided into sections to participate in matching, and the logic of the entire page ranking is no longer directly applicable: a section must be able to stand independently of the context in order to be quoted. Self-contained content requires a title as a question and conclusions and conditions within the paragraph. AnQiCMS uses custom fields to keep conditions in the text, and TDK with automatic tag management to manage the retrieval entry.

2026-10-26

The plugin vulnerability has entered into wild exploitation, what mitigation actions can the official website take before the patch is released?

After the plugin vulnerability enters into wild exploitation, the window before the patch is released needs to be handled in the order of mitigation: first confirm which layer is exposed and cut off the writable entry, then obtain a recoverable backup point, then tighten up login and form access, and finally write down what extensions are installed in the ledger. Bricksforge's CVE-2026-85097 belongs to this category, and AnQiCMS uses built-in authentication, filtering, and backup to shorten this window.

2026-10-26