CVE-2026-7389 is a SQL injection vulnerability affecting EyouCMS versions 1.7.0 through 1.7.9. The flaw exists in the GetSortData function of application/common.php, where the sort_asc parameter is not properly sanitized, enabling remote attackers to inject malicious SQL code. The vulnerability can be exploited without authentication or user interaction. Although the issue was reported early to the project, there has been no official fix or remediation guidance published. The CVSS 4.0 vector indicates low complexity and no privileges required, with partial impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The medium CVSS score reflects partial impact on confidentiality, integrity, and availability, but the absence of an official patch increases risk for affected deployments. There is no confirmed evidence of exploitation in the wild at this time.

No official fix or patch is currently available from the vendor. Users of EyouCMS versions 1.7.0 through 1.7.9 should consider implementing temporary mitigations such as input validation or web application firewalls to block malicious payloads targeting the sort_asc parameter. Monitor vendor channels for updates or patches addressing this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.