CVE-2026-94110 Overview
A SQL injection vulnerability affects QCMS versions up to 6.0.6. The flaw resides in the self_Tmp function within Lib/Config/Controllers.php, part of the Content Detail Page component. Attackers can manipulate the ID argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable without authentication or user interaction, and the exploit has been publicly disclosed. A notable exploitation detail: the QCMS router consumes the raw REQUEST_URI without URL decoding, so payloads must contain literal spaces because %20 is not decoded before route parsing. According to the disclosure, the vendor was contacted early but responded with profanity rather than remediation.
Critical Impact
Unauthenticated remote attackers can inject SQL statements through the Content Detail Page ID parameter, potentially exposing or modifying database contents in QCMS deployments up to 6.0.6.
Affected Products
- QCMS versions up to and including 6.0.6
- Component: Content Detail Page
- Library: Lib/Config/Controllers.php (function self_Tmp)
Discovery Timeline
- 2026-09-21 - CVE-2026-94110 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-94110
Vulnerability Analysis
The vulnerability is a SQL injection flaw [CWE-74] in the self_Tmp function inside Lib/Config/Controllers.php. The function processes the ID argument supplied via the Content Detail Page without proper sanitization or parameterization. Attackers can append SQL syntax to the ID value and alter the intended query. Because the flaw is reachable over the network without credentials, exploitation requires only crafted HTTP requests to a vulnerable endpoint.
Root Cause
The root cause is unsanitized use of user-controlled input within a SQL query construction path. The self_Tmp function concatenates the ID parameter directly into the query rather than using prepared statements or a parameterized query interface. Any input passed as ID is interpreted as part of the SQL statement.
Attack Vector
Attackers deliver crafted HTTP requests targeting the Content Detail Page route. A quirk in the QCMS router complicates exploitation: the router reads REQUEST_URI in its raw form and does not URL-decode it before route parsing. Payloads containing %20 are not decoded to spaces, so attackers must supply literal spaces within the URI to have their SQL syntax recognized by the backend query builder. Once the payload is parsed, the malicious ID value is passed to self_Tmp and executed against the database.
No verified exploit code is published in the referenced advisories. See the GitHub CVE Issue Discussion and VulDB Vulnerability Details for further technical context.
Detection Methods for CVE-2026-94110
Indicators of Compromise
- HTTP requests to Content Detail Page routes containing SQL keywords such as UNION, SELECT, SLEEP, or OR 1=1 within the ID parameter.
- Requests containing literal spaces in the URI path or query string targeting QCMS endpoints.
- Unexpected database errors, long-running queries, or anomalous response times originating from the QCMS application layer.
Detection Strategies
- Deploy web application firewall (WAF) signatures that inspect the ID parameter for SQL metacharacters on QCMS routes.
- Enable verbose query logging on the backing database and alert on syntactically unusual queries generated by the QCMS process.
- Correlate application access logs with database audit trails to identify parameter tampering against the Content Detail Page.
Monitoring Recommendations
- Monitor egress from QCMS servers for unusual data volumes that may indicate database exfiltration.
- Baseline typical ID parameter values (numeric identifiers) and alert on deviations that contain non-numeric characters or SQL syntax.
- Track authentication and privilege changes on the database account used by QCMS for signs of post-exploitation activity.
How to Mitigate CVE-2026-94110
Immediate Actions Required
- Restrict network exposure of QCMS instances behind authenticated reverse proxies or IP allowlists until a patch is available.
- Deploy WAF rules that block SQL metacharacters and encoded payloads in requests to the Content Detail Page.
- Rotate database credentials used by QCMS and enforce least-privilege permissions on the QCMS database account.
Patch Information
No vendor patch is referenced in the available advisories. The disclosure notes that vendor contact did not result in remediation. Organizations running QCMS 6.0.6 or earlier should track the VulDB CVE Summary for updates and consider migrating to an actively maintained CMS if no fix is forthcoming.
Workarounds
- Add server-side input validation in front of QCMS that rejects any non-numeric ID values before they reach the application.
- Configure the database user assigned to QCMS with read-only access where feasible to limit the impact of a successful injection.
- Terminate and inspect requests containing literal spaces in the URI path targeting Content Detail Page routes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.