CVE-2026-10202: OFCMS 1.1.3 SQL Injection Vulnerability

CVE-2026-10202 Overview

CVE-2026-10202 is a SQL injection vulnerability in OFCMS version 1.1.3. The flaw resides in the Query function of \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemDictController.java, which is part of the JSON Query Interface component. Attackers can manipulate input parameters to inject arbitrary SQL statements. The attack is exploitable remotely and requires low privileges. A public exploit is available, increasing the likelihood of opportunistic use against exposed installations. The OFCMS project was notified through an issue report but has not yet responded with a fix. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Remote authenticated attackers can inject SQL queries against the OFCMS administrative dictionary interface, exposing or modifying backend database content.

Affected Products

OFCMS 1.1.3
Component: JSON Query Interface (SystemDictController.java)
Function: Query

Discovery Timeline

2026-06-01 - CVE-2026-10202 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10202

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the OFCMS administrative backend. The Query function within SystemDictController.java handles requests routed through the JSON Query Interface. User-supplied input is incorporated into a SQL statement without proper neutralization of special characters, allowing an attacker to alter the structure of the executed query.

The attack is initiated remotely over the network. Successful exploitation can disclose dictionary data, modify configuration records, or pivot to broader database interaction depending on the underlying database engine and account privileges. Because the vulnerable controller is part of the admin module, the attacker requires authenticated access at a low privilege level. Public exploit details are referenced through VulDB, raising the risk of automated probing against exposed OFCMS deployments.

Root Cause

The root cause is improper input neutralization [CWE-74] in the Query handler of SystemDictController.java. Request parameters consumed by the JSON Query Interface are concatenated into a SQL statement rather than being bound through parameterized queries or an ORM-safe query builder. This allows SQL metacharacters to break out of the intended query context.

Attack Vector

An authenticated attacker submits crafted JSON payloads to the dictionary query endpoint backed by the Query function. By embedding SQL syntax in parameters that are interpolated into the query, the attacker manipulates query logic. No user interaction beyond authentication is required, and exploitation can be performed from any network-reachable client. The exploit has been published, lowering the technical barrier to abuse.

No verified proof-of-concept code is reproduced here. See the VulDB advisory and the Gitee issue tracker entry for technical references.

Detection Methods for CVE-2026-10202

Indicators of Compromise

Unusual JSON POST requests to OFCMS admin endpoints invoking the dictionary Query function with SQL metacharacters such as single quotes, UNION, SLEEP, or comment sequences.
Database error responses or abnormally long response times correlated with admin dictionary requests, indicating blind or time-based injection attempts.
Authenticated admin sessions issuing query payloads from atypical source IP addresses or user agents.

Detection Strategies

Inspect web server and application logs for parameter values containing SQL operators directed at SystemDictController routes.
Deploy web application firewall rules that flag SQL injection patterns in JSON request bodies targeting OFCMS admin paths.
Enable database query auditing to capture statements originating from the OFCMS application user and alert on syntactically anomalous queries against dictionary tables.

Monitoring Recommendations

Forward OFCMS application logs and database audit events to a centralized analytics platform for correlation.
Baseline normal admin dictionary query traffic and alert on deviations in payload structure or frequency.
Monitor authentication logs for admin account compromise that could precede injection attempts.

How to Mitigate CVE-2026-10202

Immediate Actions Required

Restrict network access to the OFCMS administrative interface using firewall rules, VPN, or IP allowlisting until a patch is available.
Audit and rotate credentials for all OFCMS admin accounts, enforcing strong passwords and multi-factor authentication where supported.
Review database logs for evidence of prior injection attempts against the dictionary endpoint.
Apply least-privilege principles to the database account used by OFCMS to limit the blast radius of a successful injection.

Patch Information

No official patch is available at the time of publication. According to the advisory, the OFCMS project was informed through an issue report but has not responded. Track the Gitee issue tracker entry and the VulDB record for updates on a vendor fix.

Workarounds

Disable or block access to the JSON Query Interface backing SystemDictController.Query at the reverse proxy or WAF layer if it is not required for operations.
Apply WAF signatures that reject requests containing SQL injection patterns destined for OFCMS admin routes.
Deploy database-level controls such as read-only roles and statement allowlisting to limit damage from injected queries.
Consider taking the OFCMS admin module offline from untrusted networks until a vendor patch is published.

bash

# Example nginx restriction limiting OFCMS admin access to trusted networks
location /ofcms-admin/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://ofcms_backend;
}