CVE-2026-10193 in OFCMS
Summary
by MITRE • 05/31/2026
A security flaw has been discovered in OFCMS up to 1.1.3. The impacted element is the function Query of the file ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\ComnController.java of the component ComnController. Performing a manipulation of the argument system.user.query results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/01/2026
The vulnerability identified in OFCMS version 1.1.3 represents a critical sql injection flaw within the ComnController component that poses significant security risks to affected systems. This vulnerability resides in the Query function of the ComnController.java file, specifically targeting the system.user.query argument handling mechanism. The flaw allows attackers to manipulate input parameters and execute arbitrary sql commands against the underlying database, potentially leading to complete system compromise and data exfiltration. The vulnerability has been publicly disclosed and is actively being exploited in the wild, making immediate remediation essential for organizations running affected versions of the software.
The technical implementation of this vulnerability stems from inadequate input validation and parameter sanitization within the ComnController's Query method. When the system.user.query parameter is processed, the application fails to properly escape or parameterize user-supplied input before incorporating it into sql queries. This allows malicious actors to inject sql payload through crafted input values that manipulate the query execution flow. The vulnerability is classified as a direct sql injection attack vector, where attacker-controlled data is concatenated directly into sql statements without proper sanitization, enabling unauthorized database access and potential privilege escalation. The flaw directly maps to CWE-89, which specifically addresses sql injection vulnerabilities in software applications.
The operational impact of this vulnerability extends beyond simple data theft to encompass complete system compromise and potential lateral movement within network environments. Attackers can leverage this vulnerability to extract sensitive user credentials, personal information, financial data, and other confidential database contents. The remote exploit capability means that attackers do not require physical access to the target system, making the vulnerability particularly dangerous in internet-facing applications. Organizations may experience service disruption, regulatory compliance violations, and reputational damage when such vulnerabilities are exploited. The vulnerability also provides attackers with a potential foothold for further attacks, including privilege escalation and persistence mechanisms.
Mitigation strategies for this vulnerability should prioritize immediate patching of the affected OFCMS version to the latest available release that addresses the sql injection flaw. Organizations should implement proper input validation and parameterized queries in all database interactions to prevent similar vulnerabilities from occurring in the future. Network segmentation and firewall rules should be configured to limit access to administrative interfaces and database servers. The implementation of web application firewalls and intrusion detection systems can help detect and prevent exploitation attempts. Additionally, organizations should conduct comprehensive security assessments of their web applications to identify and remediate similar sql injection vulnerabilities throughout their infrastructure. The vulnerability's classification under ATT&CK technique T1190 indicates that it should be treated as a critical threat requiring immediate attention and layered defensive measures to protect against exploitation attempts.