What to pay attention to after upgrading v3.6.6 after fixing two high-risk issues

The AnQiCMS v3.6.6 version was released on October 8, 2026, and fixed two high-risk security issues: SQL injection in list sorting parameters and the possibility of forgeable login credentials when switching sites. It is recommended to rotate the site signature key and change the administrator password during the upgrade to completely eliminate the risk of abuse of old credentials. This update also strengthened the input validation of sorting parameters, blocking the attack path of constructing malicious SQL statements through URL parameters.

What is the SQL injection vulnerability in sorting parameters?

The sorting function on the list page allows users to specify the sorting field and direction through URL parameters, for example,?order=created_at&dir=descBefore v3.6.6, some sorting parameters were not properly filtered before being concatenated directly into SQL queries, allowing an attacker to construct special sorting values to inject additional SQL statements into the query.

The danger of this type of injection attack lies in the fact that, once executed successfully, the attacker may be able to read sensitive information from the database, or even modify or delete data. Although AnQiCMS has built-in JWT authentication and content sensitive word filtering protection mechanisms, the sorting parameters are located in the request URL, bypassing some routine checks.

v3.6.6 has implemented whitelisting for sorting parameters, allowing only predefined field names to appear in the ORDER BY clause. Any value not on the whitelist will be rejected, blocking the injection path at its source.

How is the login credential forgery risk generated during site switching?

Multi-site management is one of the core capabilities of AnQiCMS, supporting the management of multiple independent sites on the same backend. During the site switching process, the system needs to verify whether the current user's identity is still valid in the new site.

In versions prior to v3.6.6, there was a possibility of login credentials being forged during site switching. Attackers could bypass authentication logic by constructing specific credential data to access other sites非法ly. This vulnerability is particularly dangerous in multi-site deployments, as the downfall of one site could affect the entire cluster.

The fix introduced a stricter credential verification mechanism and recommends rotating the site signature key after upgrading. The site signature key is a critical parameter used for signing and verifying login tokens. After rotation, all old forged credentials will become invalid.

Why rotate the site signature key after upgrading?

The site signature key is similar to an encryption key, used to generate and verify JWT tokens. If an attacker obtains valid login credentials during a vulnerability exposure period, even if the vulnerability has been fixed, these credentials will still be available until the site signature key is rotated.

Rotating the site signature key operation will make all existing tokens invalid, forcing all users to re-login. Although this step may bring temporary inconvenience, it ensures that no old credentials remain. Accompanied by changing the administrator's password, it can completely cut off the attacker's possible continuous access path.

The one-time ticket mechanism has also been strengthened in this update. The ticket becomes invalid immediately after use, preventing replay attacks. Even if the attacker intercepts a legitimate login request, they cannot reuse the ticket for a second login.

What are the precautions for the upgrade steps?

To upgrade to v3.6.6, you need to follow the sequence of operations below to ensure that the security fixes take effect:

Step 1: Backup the database and configuration files. Before performing any upgrade operations, make a complete backup of the current system's database and config directory. AnQiCMS supports data backup functions, including the backup and recovery of static files, which can be operated directly in the background.

Second step: Download the v3.6.6 installation package. Obtain the latest version from the official channel, verify the integrity of the file, and then upload it to the server. If deploying with Docker, you can pull the latest anqicms/anqicms image.

Third step: Replace the program files and restart the service. Stop the currently running service, replace the old version with the new version of the file, and then restart. The default listening port is 8001, and Baota panel users can complete the deployment with one click.

Fourth step: Rotate the site signature key. Find the site signature key field in the configuration file, generate a new random string to replace the old value. Save and restart the service to make the change take effect.

Step 5: Modify the administrator password. After logging in with the new site signature key, immediately modify the passwords of all administrator accounts. This step ensures that even if the old password is leaked, it can no longer be used to log in.

Step 6: Verify that the features are working normally. Check if the core functions such as list sorting, site switching, and user login are working normally. Observe whether there are any abnormal requests in the logs and confirm that the injection attack path has been blocked.

Common questions

Question: What risks are there if the site signature key is not rotated?

Answer: The old credentials are still valid, and attackers may continue to use the legitimate tokens obtained previously to access the system. Rotation is the necessary step to eliminate residual risks.

Question: Does v3.6.6 affect existing plugins or templates?

Answer: This update mainly involves security fixes and does not change the public API and template tag interface. Under normal circumstances, there is no need to adjust the existing extensions.

Question: How can you confirm that your version has this vulnerability?

Answer: Check the version number in the config/constant.go file. All versions below 3.6.6 are affected. It is recommended to upgrade to the latest version as soon as possible.