CVE-2026-19354: lock-upme OPMS SQL Injection Vulnerability

CVE-2026-19354 Overview

CVE-2026-19354 is a SQL injection vulnerability in the lock-upme OPMS project, affecting versions up to commit 831440f37a92c1568f2e071d5233bc873a9d8b09. The flaw resides in an unknown function within controllers/messages/message.go, part of the IN Clause Handler component. Attackers can manipulate the ids argument to inject arbitrary SQL statements. The attack is exploitable remotely and requires low privileges. OPMS follows a rolling release strategy, so specific fixed version identifiers are not published. The vendor was contacted before public disclosure but did not respond.

Critical Impact
Authenticated remote attackers can inject SQL through the ids parameter in the message controller, potentially exposing or modifying data stored by the application.

Affected Products

lock-upme OPMS through commit 831440f37a92c1568f2e071d5233bc873a9d8b09
Component: controllers/messages/message.go (IN Clause Handler)
Rolling release branch — no fixed version identifier published

Discovery Timeline

2026-08-09 - CVE-2026-19354 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19354

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected code path is inside the message controller of OPMS, a Go-based application. When the handler builds a SQL IN (...) clause using the ids argument, user-supplied values are concatenated into the query rather than bound as parameters. This allows an attacker who can invoke the endpoint to break out of the intended clause and append arbitrary SQL syntax.

Because the IN clause typically accepts a variable number of comma-separated values, developers frequently build these queries through string concatenation, bypassing the safety of prepared statements. The result is direct SQL execution against the backend database with the privileges of the application account.

Root Cause

The root cause is the lack of input sanitization and parameterization when constructing the SQL IN clause. The ids parameter is inserted into the query string without escaping or type validation. Any client authorized to reach the endpoint can submit crafted payloads that are executed as SQL.

Attack Vector

Exploitation is performed over the network against the vulnerable HTTP endpoint. The attacker must hold low-privilege credentials but no user interaction is required. By submitting a crafted ids parameter containing SQL metacharacters, the attacker can extract database records, alter stored data, or probe the database schema. See the VulDB entry for CVE-2026-19354 for additional technical context.

No verified proof-of-concept code has been published in the referenced advisories. The vulnerability manifests when the IN clause handler concatenates the ids argument directly into a SQL statement. Refer to the VulDB vulnerability record #387208 for further analysis.

Detection Methods for CVE-2026-19354

Indicators of Compromise

HTTP requests to message-related endpoints containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in the ids parameter.
Database logs showing malformed queries against message tables originating from the OPMS application account.
Unusually large or slow responses from the message controller consistent with time-based or UNION-based SQL injection probing.

Detection Strategies

Enable verbose query logging on the database backing OPMS and alert on syntactically anomalous statements referencing message tables.
Deploy web application firewall rules that inspect the ids parameter for SQL injection signatures.
Correlate authentication logs with request patterns to identify low-privilege accounts issuing unusual bulk queries.

Monitoring Recommendations

Monitor outbound traffic from the OPMS host for signs of data exfiltration following suspicious database activity.
Track error rates and 500-series responses from the message controller endpoints as an early signal of injection attempts.
Baseline normal ids parameter shapes (numeric, comma-separated) and alert on deviations.

How to Mitigate CVE-2026-19354

Immediate Actions Required

Restrict network access to OPMS to trusted administrative networks until a fix is applied.
Audit user accounts and revoke or rotate low-privilege credentials that are not strictly required.
Review database logs for prior evidence of injection attempts against message endpoints.

Patch Information

No official patch has been released. The vendor did not respond to disclosure attempts, and OPMS follows a rolling release model with no versioned fix. Operators should track the upstream repository references and apply local remediation until a maintainer-supplied fix is available.

Workarounds

Modify controllers/messages/message.go locally to construct the IN clause with parameterized placeholders rather than string concatenation.
Validate that the ids argument contains only numeric values before it reaches the query builder.
Enforce least-privilege on the database account used by OPMS so injection cannot escalate to schema modification.

bash

# Example nginx location block to enforce numeric ids and block injection payloads
location /messages/ {
    if ($arg_ids !~ "^[0-9]+(,[0-9]+)*$") {
        return 400;
    }
    proxy_pass http://opms_backend;
}