This vulnerability in JiZhiCMS (up to version 2.5.6) arises from improper handling of the sqls argument in the htmlspecialchars_decode function located in /index.php/admins/Sys/addcache.html. An attacker can remotely exploit this flaw to inject SQL commands, potentially compromising the database. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, and no user interaction required. The vendor has not issued any patch or advisory, and no remediation level is specified.

Successful exploitation of this vulnerability allows remote attackers to perform SQL injection attacks against JiZhiCMS installations up to version 2.5.6. This can lead to unauthorized database queries, data leakage, or modification depending on the database privileges. Since the vulnerability is remotely exploitable without user interaction and the exploit is public, affected systems are at risk until mitigated.

No official patch or remediation is currently available from the vendor. Users should consider implementing application-level protections such as web application firewalls to detect and block SQL injection attempts targeting the affected endpoint. Monitoring and restricting access to the /index.php/admins/Sys/addcache.html resource may reduce exposure. Stay alert for any future vendor advisories or patches and apply them promptly once available.