CVE-2026-10203: OFCMS 1.1.3 SQL Injection Vulnerability

CVE-2026-10203 Overview

CVE-2026-10203 is a SQL injection vulnerability affecting OFCMS 1.1.3, an open-source content management system. The flaw resides in the Query function of \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemParamController.java, which is part of the JSON Query Interface component. Attackers can manipulate input parameters to inject arbitrary SQL statements. The vulnerability requires low-level authentication and is exploitable remotely over the network. A public exploit has been released, and the project maintainers have not responded to the issue report disclosed via Gitee. This vulnerability is tracked under CWE-74 for improper neutralization of special elements in output.

Critical Impact
Authenticated remote attackers can inject SQL into the OFCMS administrative SystemParamController JSON Query Interface, compromising database confidentiality and integrity.

Affected Products

OFCMS 1.1.3
Component: JSON Query Interface (SystemParamController.java)
Function: Query

Discovery Timeline

2026-06-01 - CVE-2026-10203 published to NVD
2026-06-01 - Last updated in NVD database
Status - Vendor informed via Gitee Issue Report; no response at time of disclosure

Technical Details for CVE-2026-10203

Vulnerability Analysis

The vulnerability resides in the Query function within SystemParamController.java, located in the OFCMS administrative backend. This controller exposes a JSON Query Interface that accepts user-supplied parameters and incorporates them into SQL statements without proper sanitization or parameterized queries. Authenticated users with low privileges can submit crafted JSON payloads that alter the intended query logic. Successful exploitation enables database content extraction, unauthorized record modification, and potential lateral movement within the application's data layer. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed OFCMS instances.

Root Cause

The root cause is improper neutralization of special elements used in a downstream SQL component, classified as [CWE-74]. The Query method concatenates request-derived values directly into SQL strings rather than using prepared statements with bound parameters. Input validation and output encoding are absent for query parameters supplied through the JSON interface.

Attack Vector

The attack vector is network-based and requires low-level authentication to the OFCMS administrative interface. An attacker sends a crafted HTTP request to the JSON Query endpoint exposed by SystemParamController, embedding SQL metacharacters into a parameter consumed by the Query function. The injected SQL is executed in the context of the application's database user. No user interaction is required beyond the attacker's own request. See the VulDB entry for CVE-2026-10203 and the VulDB vulnerability record #367483 for additional technical context.

Detection Methods for CVE-2026-10203

Indicators of Compromise

HTTP requests targeting the OFCMS admin path that invokes SystemParamController with SQL metacharacters (', --, UNION, SELECT, OR 1=1) inside JSON fields.
Database error messages or unexpected response payloads originating from the JSON Query Interface.
Anomalous query patterns in database logs referencing system_param or related administrative tables from the OFCMS application user.

Detection Strategies

Inspect application and web server logs for POST or GET requests to SystemParamController endpoints containing SQL syntax tokens.
Enable database query logging and review for malformed or unusually long statements issued by the OFCMS service account.
Deploy a web application firewall rule set covering SQL injection signatures targeting JSON-formatted request bodies.

Monitoring Recommendations

Alert on authenticated admin sessions that submit a high volume of requests to the JSON Query Interface in a short window.
Monitor for outbound database connections or data egress immediately following requests to SystemParamController.
Track failed login attempts followed by successful authentication on the OFCMS admin interface to detect credential abuse preceding exploitation.

How to Mitigate CVE-2026-10203

Immediate Actions Required

Restrict network access to the OFCMS administrative interface to trusted IP ranges using a reverse proxy or firewall.
Rotate credentials for all low-privilege and administrative OFCMS accounts to limit exposure from credential reuse.
Audit OFCMS application and database logs for prior exploitation attempts referencing SystemParamController.
Disable or block the JSON Query Interface route at the proxy layer if it is not required for operations.

Patch Information

No vendor patch is available at the time of publication. The project was notified through the Gitee Issue Report but has not responded. Organizations running OFCMS 1.1.3 should treat this as an unpatched vulnerability and apply compensating controls until a fix is released. Track the VulDB CVE-2026-10203 record for updates.

Workarounds

Place OFCMS behind a web application firewall with SQL injection rules tuned for JSON request bodies.
Enforce least-privilege for the database account used by OFCMS, removing rights to write, drop, or access tables outside the application schema.
Require multi-factor authentication for all OFCMS administrative accounts to raise the bar for the authenticated attack precondition.
Consider migrating to an alternative CMS if the vendor remains unresponsive and the JSON Query Interface cannot be safely isolated.

bash

# Example nginx restriction limiting access to the OFCMS admin interface
location /ofcms-admin/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://ofcms_backend;
}