Executive brief
OFCMS, a content management system, contains a security flaw in its administrative interface. An attacker with low-level access can manipulate database queries to extract sensitive information, such as administrator passwords. This could lead to full system takeover and unauthorized access to website content and user data.
Technical details
A SQL injection vulnerability exists in OFCMS up to version 1.1.3 within the `query` function of `ComnController.java`. The root cause is the improper validation of the `field` and `sort` parameters, which are directly concatenated into the `ORDER BY` clause of SQL queries defined in `user.sql`. A remote attacker with authenticated access (PR:L) can exploit this by supplying malicious SQL expressions in the `field` parameter to perform blind SQL injection. This allows for the extraction of sensitive database information, such as the administrator's hashed password. A public exploit has been released, and the vendor has not yet responded to the issue report.
Affected products
- Oufu OFCMS up to 1.1.3
Timeline
- 2026-05-07: disclosed: Issue reported on Gitee repository
- 2026-05-31: advisory: NVD/VulDB publication date