CVE-2026-10203: SQL Injection in OFCMS 1.1.3 JSON Query Interface

Technical summary

CVE-2026-10203 is a SQL injection vulnerability (CWE-89, CWE-74) in OFCMS 1.1.3's JSON Query Interface. The vulnerable code path traverses through \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemParamController.java, specifically in the Query function. The vulnerability stems from insufficient input validation on query parameters, permitting attackers to craft malicious SQL that the application executes directly against the backend database. The attack requires valid authentication (CVSS vector PR:L) but no user interaction.

Business impact

Exploitation enables unauthorized database access, data exfiltration, and potential data modification. Attackers with valid credentials can query or manipulate sensitive information stored in the CMS database, including user data, configuration parameters, and potentially customer records. While the severity is moderate, the presence of public exploit code and lack of vendor response significantly elevate operational risk for organizations running OFCMS 1.1.3 in production.

Affected systems

OFCMS version 1.1.3 is confirmed vulnerable. Organizations running this version with accessible admin interfaces face direct risk. The vulnerability requires network access to the admin panel and valid authentication credentials, limiting but not eliminating the attack surface.

Exploitability

Public exploits are available, reducing the barrier to weaponization. Exploitation requires valid admin or authenticated user credentials, making this suitable for lateral movement scenarios or attacks from compromised internal accounts. The CVSS score of 6.3 (MEDIUM) reflects the authentication prerequisite; however, the presence of public tooling and lack of vendor acknowledgment warrant elevated practical concern.

Remediation

Upgrade OFCMS to a patched version once available from the vendor. In the interim, enforce strict access controls on the admin panel, restrict network access to the \ofcms-admin interface via firewall or VPN, and monitor database query logs for anomalous SQL patterns. Verify the vendor advisory for patch availability and recommended upgrade paths.

Patch guidance

Monitor OFCMS project channels and vendor advisories for an official patch release. As of the vulnerability publication date (2026-06-01) and last modification (2026-06-17), no patch version has been officially released. Contact the OFCMS vendor directly to confirm patching timelines. Test any patch in a non-production environment before deployment.

Detection guidance

Monitor database query logs for evidence of UNION-based, time-based, or boolean-based SQL injection attempts originating from the admin interface. Look for encoded SQL keywords, unusual query patterns, or repeated failed/successful query attempts. Web application firewalls should be configured to detect and block common SQL injection payloads in the Query parameter. Audit admin account usage and session logs for unauthorized or suspicious authentication patterns.

Why prioritize this

Although classified MEDIUM severity, this vulnerability merits prompt attention due to the combination of public exploit availability, vendor non-responsiveness, and the insider-threat or lateral-movement risk posed by authenticated attack scenarios. Organizations should prioritize patching once available, particularly for internet-facing or multi-tenant OFCMS deployments.

Risk score, explained

CVSS 6.3 reflects the requirement for valid authentication (PR:L), network accessibility (AV:N), and low complexity (AC:L), with limited scope and combined confidentiality, integrity, and availability impact (C:L/I:L/A:L). However, the practical risk is amplified by public exploit availability and the lack of vendor response, warranting monitoring and proactive remediation planning beyond the base score alone.

Frequently asked questions