Executive brief
Qcms is a content management system used to manage website data and operations. A SQL injection vulnerability in the backend tableField_Action component allows an authenticated or remote attacker to execute arbitrary SQL queries, potentially exposing, modifying, or deleting sensitive database contents. This could lead to unauthorized access to customer data, system compromise, or complete operational disruption.
Technical details
The vulnerability is a SQL injection flaw in the tableField_Action backend API endpoint of Qcms v.6.0.6, caused by insufficient input validation and direct SQL string concatenation without proper parameterization. The affected component fails to validate user-supplied parameters before constructing SQL queries, and the underlying PDO layer protection is ineffective. Attackers can exploit this via multiple techniques including error-based injection (using GTID_SUBSET algorithm) and time-based blind injection (using SLEEP delays) to extract arbitrary data or execute commands. The vulnerability is exploitable remotely with a CVSS score of 9.8, indicating critical severity; patches or secure fixed code implementing parameterized queries are reportedly available.
Affected products
- Qcms Qcms 6.0.6
Timeline
- 2026-07-04: disclosed
- 2026-08-17: advisory