CVE-2026-10204: OFCMS 1.1.3 SQL Injection Vulnerability

CVE-2026-10204 Overview

CVE-2026-10204 is a SQL injection vulnerability in OFCMS version 1.1.3. The flaw resides in the Query function within \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SysUserController.java, part of the JSON Query Interface component. Attackers can manipulate request parameters to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and requires low privileges. A public exploit has been released, increasing the risk of opportunistic attacks. The project maintainers were notified through an issue report but have not responded at the time of disclosure. The weakness is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can inject SQL statements through the OFCMS administrative JSON Query Interface, exposing data confidentiality, integrity, and availability of the backend database.

Affected Products

OFCMS 1.1.3
OFCMS admin module (ofcms-admin)
SysUserController.java JSON Query Interface component

Discovery Timeline

2026-06-01 - CVE-2026-10204 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10204

Vulnerability Analysis

The vulnerability affects the Query function in SysUserController.java inside the OFCMS administration module. The JSON Query Interface accepts user-controlled input and passes it into SQL statements without proper neutralization. An attacker authenticated with low privileges can inject malicious SQL fragments into the request body or query parameters. The injected payload executes against the underlying database, allowing data extraction, modification, or destructive operations such as record deletion. A working proof-of-concept exploit has been published, lowering the barrier for adversaries to weaponize the flaw. Because OFCMS is a Java-based content management system, the database backend typically holds administrative credentials, session data, and content records that become directly accessible through this injection point.

Root Cause

The root cause is improper input neutralization in the Query handler of SysUserController.java. The function concatenates attacker-controlled JSON fields into SQL statements rather than using parameterized queries or prepared statements. This pattern is the canonical condition for SQL injection and aligns with [CWE-74]. Missing whitelist validation on column names, operators, and value types compounds the defect.

Attack Vector

An attacker delivers a crafted HTTP request to the JSON Query Interface exposed by the OFCMS admin endpoint. The request body contains JSON fields where SQL metacharacters or stacked queries are embedded. After server-side processing, the manipulated SQL runs with the privileges of the OFCMS database user. Exploitation requires network reachability to the admin interface and a valid low-privileged session. Public exploit code is available, so commodity scanning and automated abuse are realistic threats. See the Gitee Issue Report and VulDB CVE-2026-10204 for additional technical context.

Detection Methods for CVE-2026-10204

Indicators of Compromise

HTTP POST or GET requests to OFCMS admin JSON Query endpoints containing SQL metacharacters such as ', --, UNION SELECT, or ;.
Database error messages or anomalous response sizes returned from SysUserController paths.
Unexpected reads or writes against OFCMS user, role, or session tables originating from the application service account.

Detection Strategies

Inspect web server and application logs for malformed JSON payloads targeting the Query function path in ofcms-admin.
Deploy web application firewall rules matching SQL injection signatures on requests to OFCMS administrative URIs.
Correlate authentication events with subsequent database query anomalies to identify post-login exploitation by low-privileged accounts.

Monitoring Recommendations

Enable database audit logging on the OFCMS schema and alert on UNION, INFORMATION_SCHEMA, or destructive DROP/DELETE statements issued by the application user.
Monitor outbound connections from the OFCMS host for data exfiltration following suspicious admin sessions.
Track the rate and diversity of failed SQL queries originating from the application, which often spike during injection probing.

How to Mitigate CVE-2026-10204

Immediate Actions Required

Restrict network access to the OFCMS admin interface to trusted management networks or VPN users only.
Audit all OFCMS administrative accounts and rotate credentials for any low-privileged users that could be abused for authenticated exploitation.
Review database and application logs for evidence of injection attempts dating back to the deployment of OFCMS 1.1.3.

Patch Information

No official patch is available at the time of publication. The OFCMS project was informed through the Gitee Issue Report but has not responded. Monitor the upstream repository for an updated release that introduces parameterized queries in SysUserController.java.

Workarounds

Place a web application firewall in front of the OFCMS admin interface and block requests containing SQL metacharacters in JSON fields handled by the Query function.
Apply least-privilege principles to the OFCMS database account, removing rights such as DROP, ALTER, and access to system tables.
Disable or firewall the JSON Query Interface route until a vendor fix is available if it is not required for operations.

bash

# Configuration example: nginx rule to block the vulnerable admin endpoint
location ~* /ofcms-admin/.*/system/sysUser/query {
    deny all;
    return 403;
}