# CVE-2026-10204: ofsoft OFCMS SQL injection in SysUserController

Source: https://junglewise.ai/threats/cve-2026-10204-ofsoft-ofcms-sql-injection-in-sysusercontroller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10204 · Severity: medium · CVSS 6.3 · Published 2026-06-01

OFCMS is a content management system used to build and manage websites. A security flaw in its administrative interface allows an attacker with low-level access to perform unauthorized database queries. This could lead to the exposure of sensitive information, such as administrator passwords, potentially compromising the entire website and its data.

## Quick answers

**Is CVE-2026-10204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10204 being exploited in the wild.

**How severe is CVE-2026-10204?** Medium severity, with a CVSS score of 6.3, published 1 June 2026.

**Which products and versions are affected?** ofsoft OFCMS 1.1.3.

**Is there a fix for CVE-2026-10204?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10204 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-10204?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A blind SQL injection vulnerability exists in OFCMS 1.1.3 within the `query` function of `SysUserController.java`. The vulnerability is located in the `/admin/system/user/getData.json` interface and is caused by the improper neutralization of the `field` and `sort` parameters. These parameters are directly concatenated into the `ORDER BY` clause of a backend SQL query defined in `user.sql`. A remote attacker with low-privileged (authenticated) access can provide malicious SQL expressions to perform boolean-based blind injection. This allows for the extraction of sensitive data, such as the administrator's hashed password, from the `of_sys_user` table. As of the advisory date, no official patch has been released by the vendor.

## Affected products

- ofsoft OFCMS 1.1.3

## Timeline

- 2026-05-07: disclosed: Issue reported to the project maintainer via Gitee
- 2026-05-31: advisory: Vulnerability details published by VulDB
- 2026-06-01: other: CVE record published to NVD dataset

## References

- [https://gitee.com/oufu/ofcms/issues/IJLL09](https://gitee.com/oufu/ofcms/issues/IJLL09)
- [https://vuldb.com/cve/CVE-2026-10204](https://vuldb.com/cve/CVE-2026-10204)
- [https://vuldb.com/submit/821697](https://vuldb.com/submit/821697)
- [https://vuldb.com/vuln/367484](https://vuldb.com/vuln/367484)
- [https://vuldb.com/vuln/367484/cti](https://vuldb.com/vuln/367484/cti)