CVE-2025-7102 is a medium severity (6.3) SQL injection flaw in BoyunCMS up to 1.4.20. The phone argument in the update server controller reaches a database query unsafely. The record lists no fixed version, so restrict access to the affected path, review the code for the same pattern and plan to replace the CMS if no patch appears.
What's affected
- Product: BoyunCMS, versions up to and including 1.4.20.
- Component:
/application/update/controller/Server.php. - Parameter:
phone. - Fixed version: none is listed in the record. Check the project site and the advisory before assuming one exists.
The NVD record gives 6.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The description, taken from VulDB, calls the issue "critical". Both statements are in the record. The formal CVSS score is the lower number, and the word "critical" is VulDB's own label. The record carries no KEV flag, and the sources do not report exploitation. It does say the exploit has been disclosed publicly.
How to check if you're exposed
BoyunCMS is a self-hosted PHP application, so check the installation directly instead of looking for a registry package.
- Find every BoyunCMS instance in your hosting inventory and web roots.
- Read the version in the admin area or in the project files. Anything up to 1.4.20 is in the record, and without a clear later release you should assume you are affected.
- Check whether
/application/update/controller/Server.phpexists on the server and is reachable from the network. - Review web server logs for requests to that path from sources you do not recognise.
- Compare your files against a clean copy of the release to spot changes you did not make.
find /var/www -path "*application*" -name "*.php" -mtime -30
Adjust the path for your layout. Recently modified files in the application tree that you did not change are worth investigating.
What to do now
- Restrict access to the vulnerable path at the web server or reverse proxy, and keep the admin area off the open internet.
- Replace the query with a prepared statement and bind the phone value as a parameter.
- Run the database and web server accounts with the fewest rights that still work.
- Look for a newer BoyunCMS release on the project's channels and read its notes. We could not confirm a fixed version, so verify this yourself.
- If you find signs of misuse, preserve logs, rebuild from a clean source and rotate secrets.
- If the project is unmaintained, schedule a move to a supported CMS.
Why it matters
The cause is the phone argument being used in a database query. The record lists CWE-74 and CWE-89, the usual pair for SQL injection.
The score is moderate because the vector requires low privileges, according to the record, and rates impact as low across confidentiality, integrity and availability. That is no reason to leave it alone. Weaknesses of this type in a CMS often chain with other flaws, and a public disclosure shortens the time you have to react. Classes in play here are CWE-74 and CWE-89.
Quick check
Is there a patch for CVE-2025-7102?
The record lists none. Check the project and the advisory yourself and treat BoyunCMS up to 1.4.20 as affected until you confirm otherwise.
Why does the record say critical when the score is 6.3?
The description comes from VulDB, which uses its own wording. The CVSS 3.1 score in the record is 6.3, which is Medium. Use the score for triage and note the label.
Sources
- NVD record for CVE-2025-7102, published 2025-07-07, CNA VulDB.
- Gold page for CVE-2025-7102
The researcher write-up linked from the record could not be retrieved when we checked on 18 October 2026, and VulDB blocks automated access, so the details above come from the NVD record.
Last reviewed: 18 October 2026.
