CVE-2026-19354 in OPMS
Summary
by MITRE • 08/09/2026
A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/09/2026
This vulnerability represents a critical sql injection flaw within the lock-upme OPMS system, specifically targeting the IN clause handler functionality in the controllers/messages/message.go file. The vulnerability stems from insufficient input validation where the ids argument parameter is directly incorporated into sql query construction without proper sanitization or parameterization. This allows attackers to manipulate the sql execution flow by injecting malicious sql code through the ids parameter, potentially enabling unauthorized data access, modification, or deletion operations.
The technical implementation of this vulnerability aligns with CWE-89 sql injection weakness, where user-supplied input flows directly into sql commands without adequate filtering or escaping mechanisms. The attack vector is classified as remote since the vulnerability can be exploited over network connections without requiring local system access. The IN clause handler component specifically processes arrays or lists of identifiers, making it particularly susceptible to manipulation when these identifiers are not properly validated against malicious input patterns.
The operational impact of this vulnerability extends beyond simple data theft, potentially allowing attackers to escalate privileges within the application's database layer and execute arbitrary commands on underlying database systems. Given that the product utilizes a rolling release strategy without fixed version identification, this creates challenges for defenders in determining specific vulnerable versions and implementing targeted patches. The lack of vendor response to early disclosure attempts compounds the risk, leaving organizations with limited remediation options while the vulnerability remains unaddressed.
Security professionals should implement immediate network-level mitigations including firewall rules that restrict access to affected components and database connections, alongside comprehensive input validation at multiple layers of the application stack. Database administrators should enable detailed logging of sql queries and monitor for suspicious patterns that may indicate exploitation attempts. The ATT&CK framework categorizes this vulnerability under initial access and privilege escalation tactics, specifically targeting T1078 valid accounts and T1213 data from information repositories. Organizations should conduct thorough code reviews focusing on sql query construction patterns and implement automated security testing tools to detect similar vulnerabilities in other application components.