This vulnerability in JiZhiCMS (versions 2.5.0 through 2.5.6) involves improper sanitization in the htmlspecialchars_decode function within the addcache.html admin script. Specifically, the 'sqls' parameter can be manipulated to perform SQL injection attacks remotely. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and partial impacts on confidentiality, integrity, and availability. No official fix or patch has been released, and the vendor has not responded to the disclosure.

Successful exploitation allows remote attackers with high privileges to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality, integrity, and availability of the affected system. However, the impact is rated medium due to partial impact metrics and the requirement for high privileges.

No official patch or remediation is currently available from the vendor, who has not responded to disclosure attempts. Users should consider restricting access to the affected functionality to trusted administrators only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.