CVE-2026-42425: OpenKM SQL Injection Vulnerability

CVE-2026-42425 Overview

CVE-2026-42425 is an unrestricted SQL execution vulnerability in OpenKM 6.3.12, a document management platform. The flaw resides in the DatabaseQuery administrative interface, which accepts arbitrary SQL statements through the qs parameter without restriction. Authenticated administrative users can submit crafted queries to the /admin/DatabaseQuery endpoint and execute them directly against the application database. Exploitation enables extraction of credentials from the OKM_USER table, modification of access permissions, and deletion of records. The issue is tracked as CWE-89: SQL Injection.

Critical Impact
Authenticated administrators can read password hashes, alter permissions, and destroy data by submitting arbitrary SQL via the qs parameter of /admin/DatabaseQuery.

Affected Products

OpenKM Community Edition 6.3.12
OpenKM Docker image openkm/openkm-ce
Deployments exposing the /admin/DatabaseQuery endpoint

Discovery Timeline

2026-05-26 - CVE-2026-42425 published to the National Vulnerability Database
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-42425

Vulnerability Analysis

OpenKM exposes a DatabaseQuery interface intended for administrative database inspection. The endpoint accepts raw SQL through the qs HTTP parameter and forwards it to the underlying database engine without parsing, allow-listing, or restricting statement types. Because no server-side filter limits the query to read operations or specific tables, attackers with administrative credentials can run SELECT, UPDATE, INSERT, or DELETE statements. The flaw maps to CWE-89 and is documented in the VulnCheck advisory.

Root Cause

The root cause is the absence of statement validation and least-privilege design in the DatabaseQuery handler. The application treats the administrative role as fully trusted and routes user-supplied SQL directly to the database connection. There is no parser-level allow list, no read-only enforcement at the database account level, and no audit on dangerous verbs.

Attack Vector

An attacker first obtains administrative credentials through phishing, password reuse, or compromise of a privileged account. The attacker then issues an HTTP POST to /admin/DatabaseQuery with a malicious payload in the qs parameter. A query such as one selecting from OKM_USER returns usernames and password hashes for offline cracking. Other payloads can update role assignments or drop document records. Public exploitation tooling is available through Exploit-DB entry 52520 and the Terra System Labs OpenKM exploits repository.

The vulnerability is described in prose only; refer to the VulnCheck advisory and the Terra System Labs research post for technical detail.

Detection Methods for CVE-2026-42425

Indicators of Compromise

HTTP POST requests to /admin/DatabaseQuery containing SQL keywords such as SELECT, UPDATE, DELETE, or UNION in the qs parameter
Database queries referencing the OKM_USER table outside normal application flows
New or modified administrative accounts in OpenKM following access to DatabaseQuery
Nuclei scanner signatures matching the OpenKM SQL DatabaseQuery template

Detection Strategies

Alert on any access to /admin/DatabaseQuery and correlate with the authenticating user and source IP
Inspect web server and reverse proxy logs for the qs parameter and decode its contents for SQL verbs
Enable database audit logging to capture statements issued by the OpenKM service account and flag references to credential tables

Monitoring Recommendations

Forward OpenKM application logs, web server logs, and database audit logs to a centralized analytics platform for correlation
Track administrative session activity and alert on rare endpoints such as DatabaseQuery being invoked
Monitor for bulk exports of user records or sudden permission changes within OpenKM

How to Mitigate CVE-2026-42425

Immediate Actions Required

Restrict network access to /admin/DatabaseQuery using a reverse proxy or web application firewall rule
Rotate all OpenKM administrative passwords and force re-authentication for privileged users
Audit recent access logs for unauthorized requests to the DatabaseQuery endpoint and review the OKM_USER table for unexpected accounts
Reduce the OpenKM database account to least-privilege rights where business processes permit

Patch Information

No vendor patch is referenced in the available advisories at the time of NVD publication. Consult the OpenKM official website for vendor updates and the VulnCheck advisory for advisory tracking. Until a fix is published, treat the DatabaseQuery interface as an unsafe administrative function and gate access at the network layer.

Workarounds

Block external and internal traffic to /admin/DatabaseQuery at the WAF or reverse proxy and permit only specific administrative IP addresses
Disable or remove the DatabaseQuery servlet mapping in the OpenKM deployment descriptor if operationally feasible
Enforce multi-factor authentication on all OpenKM administrator accounts to reduce credential compromise risk
Run the OpenKM database connection under an account without UPDATE, DELETE, or DROP privileges on sensitive tables

bash

# Example nginx rule to block external access to the DatabaseQuery endpoint
location /admin/DatabaseQuery {
    allow 10.0.0.0/24;   # restrict to admin subnet
    deny  all;
    return 403;
}