Executive brief
OFCMS is a content management system used for building and managing websites. A security vulnerability in its administrative interface allows an attacker with low-level access to execute unauthorized database commands. This could lead to the exposure of sensitive information, such as administrator passwords, or the disruption of website operations.
Technical details
An SQL injection vulnerability exists in the SystemDictController.java component of OFCMS v1.1.3. The vulnerability is located in the /admin/system/dict/query.json interface within the query() method. The root cause is the improper validation of the 'field' and 'sort' parameters, which are directly concatenated into the ORDER BY clause of a backend SQL query. A remote attacker with authenticated access can exploit this by submitting crafted SQL expressions to perform blind SQL injection. This allows for the extraction of sensitive data, such as the administrator's hashed password, from the of_sys_user table. As of the advisory date, the project has not responded to the issue report.
Affected products
- Oufu OFCMS 1.1.3
Timeline
- 2026-05-07: disclosed: Issue reported on Gitee repository
- 2026-05-31: advisory: VulDB entry created
- 2026-06-01: advisory: NVD publication date