Executive brief
OFCMS is a content management system used to build and manage websites. A security flaw in its administrative interface allows an attacker with low-level access to perform unauthorized database queries. This could lead to the exposure of sensitive information, such as administrator passwords, potentially compromising the entire website and its data.
Technical details
A blind SQL injection vulnerability exists in OFCMS 1.1.3 within the `query` function of `SysUserController.java`. The vulnerability is located in the `/admin/system/user/getData.json` interface and is caused by the improper neutralization of the `field` and `sort` parameters. These parameters are directly concatenated into the `ORDER BY` clause of a backend SQL query defined in `user.sql`. A remote attacker with low-privileged (authenticated) access can provide malicious SQL expressions to perform boolean-based blind injection. This allows for the extraction of sensitive data, such as the administrator's hashed password, from the `of_sys_user` table. As of the advisory date, no official patch has been released by the vendor.
Affected products
- ofsoft OFCMS 1.1.3
Timeline
- 2026-05-07: disclosed: Issue reported to the project maintainer via Gitee
- 2026-05-31: advisory: Vulnerability details published by VulDB
- 2026-06-01: other: CVE record published to NVD dataset