CVE-2026-10202: OFCMS 1.1.3 SQL Injection in SystemDictController

Technical summary

CVE-2026-10202 is a SQL injection flaw in the Query function of SystemDictController.java (located at \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemDictController.java) within OFCMS 1.1.3's JSON Query Interface. The vulnerability stems from insufficient input validation on query parameters, allowing authenticated users to inject malicious SQL syntax. The flaw maps to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (SQL Injection), indicating that user-supplied input is passed unsanitized to database queries. With a CVSS 3.1 score of 6.3 (Medium severity), the attack requires network access and valid authentication but no user interaction. The low attack complexity suggests straightforward exploitation once credentials are obtained.

Business impact

Organizations running OFCMS 1.1.3 face data confidentiality and integrity risks. Attackers with valid accounts—whether obtained through credential compromise, insider threats, or shared administrative access—can extract sensitive database contents, modify records, or execute unauthorized transactions. In multi-tenant or shared hosting environments, this could enable lateral movement or data exfiltration affecting multiple business units. The public availability of exploit code accelerates the timeline for opportunistic attacks, particularly against organizations with slower patching cycles or weak credential governance.

Affected systems

OFCMS version 1.1.3 is explicitly affected. The vulnerability resides in the administrative controller, suggesting that systems with exposed admin interfaces or those accessible to internal networks are at elevated risk. Organizations should audit deployments for this specific version and assess whether the SystemDictController endpoint is reachable from untrusted network segments. No patch version information is currently available from the vendor.

Exploitability

The attack is remotely exploitable by any authenticated user without requiring special privileges or user interaction. Public exploit code is already available, lowering the barrier to exploitation. However, the requirement for valid credentials provides a partial control layer—organizations with strong access management and monitored user accounts may detect exploitation attempts. The straightforward nature of SQL injection (AC:L in the CVSS vector) means that once an attacker gains credentials, successful exploitation is likely. In environments with weak password policies or credential reuse, risk increases substantially.

Remediation

Immediate action: Disable or restrict access to the OFCMS administrative interface if not actively required, particularly from untrusted networks. Implement network segmentation to limit admin access to trusted IP ranges. Enforce strong, unique credentials for all administrative accounts and enable multi-factor authentication if supported. Review recent admin activity logs for suspicious query patterns. Long-term: Upgrade OFCMS to a patched version when available (verify against the vendor advisory for the exact version addressing this issue). If the vendor has not yet released a patch, contact OFCMS support directly for guidance. Apply database-level mitigations such as read-only query restrictions or parameterized query enforcement if the application architecture permits.

Patch guidance

As of the last update, the OFCMS project was informed of this issue but has not publicly released a patch. Verify with the official OFCMS repository and vendor advisory for the latest patched version. When a patch becomes available, prioritize deployment for systems with internet-facing or multi-user administrative access. Test patches in a staging environment to ensure compatibility with your deployment, particularly if you have custom extensions or integrations. Document the patching timeline for compliance and audit purposes.

Detection guidance

Monitor database activity logs for unusual SQL syntax or multi-statement queries originating from the OFCMS application. Alert on failed SQL execution attempts or privilege escalation queries within the context of the SystemDictController endpoint. Implement Web Application Firewall (WAF) rules to detect common SQL injection patterns in query parameters. Review access logs for the admin controller endpoint (/ofcms-admin/system/dict or equivalent routing) to identify suspicious users or repeated query attempts. Correlate authentication logs with database query logs to detect compromised credentials being exploited. Enable query auditing at the database level to capture payloads and affected tables.

Why prioritize this

While the CVSS 3.1 score of 6.3 reflects a medium severity rating, several factors warrant elevated priority: (1) public exploit code significantly reduces time-to-exploitation, (2) SQL injection is a well-understood and powerful attack vector, (3) the administrative context suggests potential for high-impact data access, and (4) the vendor's lack of response suggests this may be a legacy or abandoned product. Organizations should treat this as high-priority for systems in production, medium-priority for isolated or development instances. The authentication requirement prevents it from being critical, but only if credential controls are strong.

Risk score, explained

The CVSS 3.1 score of 6.3 (Medium) reflects the balance between impact and exploitability. The score is driven down by the requirement for valid authentication (PR:L), but driven up by the low attack complexity (AC:L), network accessibility (AV:N), and impact on confidentiality, integrity, and availability (C:L, I:L, A:L). In organizations with robust credential management and network segmentation, the practical risk may be lower. In organizations with shared credentials, weak password policies, or internet-facing admin interfaces, the effective risk approaches 'High' despite the base score. Adjust your internal risk rating based on your deployment posture and threat model.

Frequently asked questions