CVE-2026-10193: OFCMS SQL Injection Vulnerability

CVE-2026-10193 Overview

CVE-2026-10193 is a SQL injection vulnerability in OFCMS versions up to 1.1.3. The flaw resides in the Query function of ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\ComnController.java within the ComnController component. Attackers can manipulate the system.user.query argument to inject arbitrary SQL statements. The attack is exploitable remotely and requires only low-privileged authentication. A public exploit has been released, increasing the likelihood of opportunistic abuse. The project maintainers were notified through an issue report but have not responded.

Critical Impact
Authenticated remote attackers can inject SQL queries against the OFCMS administrative backend, exposing or modifying database contents.

Affected Products

OFCMS versions up to and including 1.1.3
Component: ComnController (ofcms-admin)
Function: Query handling the system.user.query parameter

Discovery Timeline

2026-05-31 - CVE-2026-10193 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10193

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The Query function within ComnController.java accepts a user-controlled system.user.query argument and passes it into a downstream SQL execution path without proper sanitization or parameterization. As a result, attacker-supplied SQL fragments are concatenated into the executed statement.

Exploitation requires network reachability to the OFCMS administrative interface and a low-privilege authenticated session. Successful injection can lead to disclosure of database contents, modification of stored records, or further pivoting within the application. The public availability of an exploit lowers the technical barrier for attackers, even though EPSS scoring suggests limited current exploitation activity in the wild.

Root Cause

The root cause is the use of dynamic SQL string concatenation against the system.user.query parameter inside the ComnControllerQuery method. The controller does not apply input validation, prepared statements, or parameter binding before forwarding the value to the data access layer.

Attack Vector

An authenticated attacker submits a crafted HTTP request to the OFCMS administrative endpoint backed by ComnController.Query. By embedding SQL metacharacters and clauses inside the system.user.query argument, the attacker alters the structure of the executed query. Refer to the Gitee Issue Discussion and the VulDB Vulnerability Overview for technical context.

// No verified proof-of-concept code is published in the referenced advisories.
// The vulnerability is triggered by supplying SQL syntax in the
// system.user.query parameter handled by ComnController.Query.

Detection Methods for CVE-2026-10193

Indicators of Compromise

HTTP requests to OFCMS admin endpoints containing SQL metacharacters such as ', --, UNION, or SLEEP( in the system.user.query parameter.
Unexpected database errors or stack traces logged by ComnController following requests to the Query action.
Authenticated sessions issuing high volumes of varied system.user.query values within short time windows.

Detection Strategies

Inspect application and web server logs for anomalous system.user.query values, focusing on encoded or boolean-based injection payloads.
Deploy WAF rules that flag SQL injection patterns targeting OFCMS admin URIs.
Correlate database audit logs with application requests to identify queries that deviate from expected OFCMS query templates.

Monitoring Recommendations

Enable verbose logging on ComnController and forward records to a centralized logging or SIEM platform for analysis.
Monitor for privilege misuse on low-privileged OFCMS accounts that could be used to satisfy the authentication requirement.
Alert on database read volumes from the OFCMS service account that exceed established baselines.

How to Mitigate CVE-2026-10193

Immediate Actions Required

Restrict network access to the OFCMS administrative interface to trusted management networks or VPN users.
Audit and rotate credentials for all OFCMS accounts, removing unused low-privilege accounts that attackers could leverage.
Place a WAF or reverse proxy in front of OFCMS with SQL injection signatures enabled for the ComnController paths.

Patch Information

No vendor patch is available at the time of publication. The maintainers were notified through the Gitee Issue Discussion but have not responded. Track the VulDB CVE Detail page for updates on a fix.

Workarounds

Disable or block external access to the ComnController.Query endpoint until a fix is released.
Apply database-level least privilege so the OFCMS service account cannot read or modify sensitive tables outside its required scope.
Implement an input filter at the reverse proxy that rejects requests containing SQL syntax in the system.user.query parameter.

bash

# Example nginx rule to block obvious SQL metacharacters in the vulnerable parameter
if ($args ~* "system\.user\.query=.*(['\"]|--|union|select|sleep\()") {
    return 403;
}