AnQiCMS v3.6.6 security upgrade: Fixed sorting parameter injection and login credential forgery vulnerabilities
What high-risk security issues were fixed in the AnQiCMS v3.6.6 version? This version was released on 2026-10-08 and addresses two high-risk issues on the login and data access chain: there is a SQL injection risk in the list sorting parameters, and login credentials can be forged under the site switching scenario. Both do not require administrative privileges as a prerequisite, so the upgrade action cannot stop at just changing the version, but also need to rotate the signature key and change the administrator password.
How does parameter injection occur?
The content management list page generally supports sorting by time, views, and other fields. The sorting field and direction are usually passed in by the front-end request parameters. If these parameters are directly concatenated into the query statement, an attacker can insert constructed values, read data that should not be returned, which is SQL injection of list sorting parameters. The stealthiness of this problem lies in the fact that the 'function looks completely normal', and it cannot be found just by observing the page behavior. It must be closed at the code level with parameterized binding and input validation.
Check in this order when troubleshooting: Whether all list interfaces with sorting and filtering go through the same layer of parameter validation; Whether there are still manual SQL query paths; Whether the database account permissions have been converged to only the necessary capabilities. Path to sorting parameters has been fixed in v3.6.6, but the records of the interface asked in the past are still worth reviewing once.
What does it mean that the credentials can be forged when switching sites?
The multi-site management allows switching between different sites within a single backend, and the switching action depends on credentials issued internally by the system. The issue fixed in this version is that such credentials can be forged, which is equivalent to obtaining an entrance ticket to impersonate a legitimate identity, and the forged credentials look indistinguishable from the genuine ones. This is also the reason why the upgrade recommendation requires rotating the signature key for all-site requests: just upgrading the code without rotating the key, the leaked signature materials may still be used.
The accompanying measure is to change the administrator's password, which changes the door held by the person, and the rotation with the signature key covers the two aspects of 'server-side materials' and 'user-side credentials'. Both should be done together, and the absence of either will leave an available old path. It should be emphasized that the signature key and the administrator's password should not appear in work orders, chat records, or code repositories, and the rotation action itself should only leave an operation record without leaving plaintext.
The sequence of upgrade and treatment
Do it in the following order to minimize the risk window:
- Perform a backup including static files, AnQiCMS supports data (including static files) backup and recovery, so that it can revert to an available state in case of upgrade issues.
- Upgrade to v3.6.6, confirm that the version number is consistent with the update records.
- Rotate the signature key for the entire site's requests, covering all sites.
- Change the administrator's password and check for any abnormal accounts or login records.
- Review the access log of the list interface, confirm whether the call of sorting parameters appears in suspicious shapes.
It should be reminded that the first step is not formal. Historically, most cases of
The relationship with other security capabilities
This version fixes the access control and query construction layer, which is complementary to the other built-in defenses of the system. AnQiCMS is built with JWT authentication, content sensitive word filtering, and anti-crawling interference code to prevent SQL injection and XSS attacks; reCAPTCHA verification code can be integrated on the form side to prevent robot submissions. The value of security capabilities lies in叠加: fixing injection paths, limiting automated submissions, and filtering non-compliant content. The three work together to determine the actual exposure surface, and looking at any one of them individually would underestimate the risk.
It is recommended for the operations team to treat version announcements as inspection items: subscribe to release records, and deal with high-risk repairs in the above order, rather than accumulating them for quarterly updates.
Common questions
Is it okay to only upgrade to v3.6.6 and not rotate the signature key?Not recommended. The fix code solves the forgery capability, but the exposed signature materials may still be attempted to be used, and key rotation is the action of closing the old path.
Will changing the administrator password affect the content being edited?It will not affect the content data, but it will affect the login status. After changing the password, all sessions need to log in again, and it is recommended to schedule it during a time when no one is releasing.
How to confirm that your site has used the fixed version?Check if the backend version information and update history show v3.6.6; in the online environment, you can also combine the release notes to verify the description of the fixed items, to avoid only updating the frontend resources without replacing the binary.