CVE-2026-10202 in OFCMS
Summary
by MITRE • 06/01/2026
A vulnerability was identified in OFCMS 1.1.3. This issue affects the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemDictController.java of the component JSON Query Interface. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/02/2026
This vulnerability in OFCMS 1.1.3 represents a critical sql injection flaw within the system dictionary management interface that poses significant security risks to affected organizations. The vulnerability is located in the Query function of the SystemDictController.java file, specifically within the JSON Query Interface component that handles administrative operations. The flaw allows malicious actors to manipulate database queries through crafted input parameters, potentially enabling unauthorized access to sensitive data and system compromise. The vulnerability's remote exploitability means that attackers can leverage this weakness without requiring physical access to the target system, making it particularly dangerous in networked environments.
The technical implementation of this vulnerability stems from insufficient input validation and sanitization within the JSON query processing mechanism. When the system processes user-supplied parameters through the Query function, it fails to properly escape or filter malicious input that could contain sql payload constructs. This allows attackers to inject arbitrary sql commands that execute within the context of the database connection, potentially leading to data exfiltration, privilege escalation, or complete system compromise. The vulnerability aligns with CWE-89 which specifically addresses sql injection flaws, and represents a direct violation of secure coding practices that mandate proper input validation and parameterized queries.
The operational impact of this vulnerability extends beyond simple data theft to encompass potential system-wide compromise and business disruption. Attackers could exploit this weakness to access sensitive administrative data, modify system configurations, or even escalate privileges to gain full control over the cms system. The fact that public exploit code exists increases the likelihood of widespread exploitation, as threat actors can readily deploy automated tools to identify and exploit vulnerable instances. Organizations running OFCMS 1.1.3 without proper mitigation measures face substantial risk of unauthorized access to their content management systems, potentially affecting thousands of users and sensitive organizational data.
Security professionals should immediately implement multiple layers of defense to protect against this vulnerability. The primary mitigation strategy involves applying the vendor-provided patch or upgrade to a supported version of OFCMS that addresses this sql injection flaw. Additionally, implementing proper input validation and parameterized queries within the affected controller would provide defense-in-depth protection. Network segmentation and access controls should be strengthened to limit exposure of the vulnerable administrative interface, while monitoring systems should be configured to detect anomalous query patterns that might indicate exploitation attempts. Organizations should also consider implementing web application firewalls and regular security assessments to identify similar vulnerabilities in other components of their cms infrastructure. The ATT&CK framework categorizes this vulnerability under the T1190 technique for exploitation of remote services, highlighting the need for comprehensive network security measures and regular vulnerability assessments to prevent successful exploitation attempts.