CVE-2026-10204: SQL Injection in OFCMS 1.1.3 JSON Query Interface

Technical summary

CVE-2026-10204 is a SQL injection flaw (CWE-89, CWE-74) residing in the Query function of SysUserController.java within OFCMS 1.1.3's JSON Query Interface component. The vulnerability stems from insufficient input validation on user-supplied parameters passed to database queries. An authenticated attacker with network access can craft malicious JSON payloads to inject SQL commands, bypassing query constraints and accessing or manipulating the underlying database. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects the network-exploitable nature, low attack complexity, and requirement for valid credentials; the impact is limited to the application's security domain.

Business impact

Exploitation enables data exfiltration, unauthorized modification of user records or configuration settings, and potential denial of service through resource-intensive queries. For organizations running OFCMS as a content or user management system, a successful attack could compromise customer data, disrupt service availability, or enable privilege escalation if database access permits lateral movement. The public availability of exploit code substantially elevates operational risk and likelihood of opportunistic attacks.

Affected systems

OFCMS version 1.1.3 is confirmed vulnerable. Earlier or later versions have not been explicitly assessed in the available advisory data; verify the affected version range through the official OFCMS project advisories. Systems with network-exposed OFCMS instances and active user authentication are at highest risk. Air-gapped or internal deployments with restricted user access present lower immediate exposure.

Exploitability

Exploitability is elevated. The attack requires valid authentication credentials, which limits the attack surface to known or compromised user accounts; however, the low attack complexity and network accessibility make it practical for insiders or attackers who have obtained user credentials through other means. Public exploit code is available, removing the requirement for attackers to develop their own payloads. No user interaction is needed once the attacker is authenticated.

Remediation

Immediately update OFCMS to a patched version released by the project (verify the specific version against official OFCMS advisories). If an update is not yet available, implement network-level access controls to restrict JSON Query Interface endpoints to trusted IP ranges, disable the Query function if unused, and enforce principle of least privilege on database accounts used by the application. Review access logs for suspicious query patterns. Consider using a Web Application Firewall (WAF) to detect and block SQL injection attempts.

Patch guidance

Consult the official OFCMS project repository and security advisories for patched release versions. Apply patches as soon as they become available. Test patches in a non-production environment first to ensure compatibility with your deployment. If the vendor has not yet released a patch despite early notification, interim mitigations (WAF rules, network segmentation, credential rotation) should be applied while awaiting a fix.

Detection guidance

Monitor database query logs for anomalous SQL patterns, such as UNION SELECT, comment sequences (-- or /**/), or time-based conditional statements in queries originating from the JSON Query Interface. Alert on authentication failures followed by repeated Query function calls from the same user account. Implement intrusion detection signatures targeting SQL injection payloads in HTTP request bodies sent to the vulnerable endpoint. Log all JSON payloads submitted to the Query function for forensic analysis.

Why prioritize this

Although the CVSS score is moderate (6.3) and the vulnerability requires authentication, the combination of public exploit availability, network accessibility, and potential for sensitive data exposure warrants prompt patching. Authenticated SQL injection in user management systems poses particular risk because database access may extend to other systems or sensitive records. Organizations should prioritize this within 30 days of patch availability.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects network accessibility and low attack complexity, offset by the requirement for prior authentication and limited scope of impact. The score does not account for the amplified risk from public exploit code; real-world risk should be assessed as elevated relative to the base score in environments where user credentials are weak, shared, or previously compromised.

Frequently asked questions