Executive brief
OFCMS, a content management system, contains a security vulnerability in its administrative interface. An attacker with low-level access can exploit this flaw to read sensitive information from the database, such as administrator passwords. This could lead to a full takeover of the website and its underlying data.
Technical details
A blind SQL injection vulnerability exists in OFCMS 1.1.3 within the SystemParamController.java component. The vulnerability is located in the /admin/system/param/query.json interface, specifically within the query() method. The root cause is the improper validation of the 'field' and 'sort' parameters, which are directly concatenated into an ORDER BY clause in the backend SQL query (system.param.query). An authenticated attacker with low privileges can provide malicious SQL expressions to perform boolean-based or time-based blind injection. This allows for the extraction of sensitive database records, including user credentials. A public exploit has been released, and while the vendor was notified via a Gitee issue, no patch is currently available.
Affected products
- Oufu OFCMS 1.1.3
Timeline
- 2026-05-07: disclosed: Issue reported on Gitee repository
- 2026-06-01: advisory: CVE published by VulDB/NVD