Executive brief
MCMS is an open-source Java content management system. An unauthenticated attacker can inject SQL commands through the size parameter in the /cms/category/list endpoint, allowing them to execute arbitrary database operations (create tables, delete data, modify records) without any credentials, potentially compromising sensitive data or disrupting service availability.
Technical details
The vulnerability is a classic SQL injection in the /cms/category/list endpoint where the size parameter is directly concatenated into the LIMIT clause of a SQL query via FreeMarker templating (${size}) without parameterization or prepared statements. The application employs a regex-based blacklist filter (SqlInjectionUtil) to detect malicious SQL, but it fails to block keywords like CREATE, TABLE, SET, PREPARE, and EXECUTE, allowing attackers to bypass the filter. Since the endpoint requires no authentication and is a front-end interface, any remote attacker can craft malicious requests (e.g., /cms/category/list?type=top&size=1;%20CREATE%20TABLE%20test724) to execute stacked SQL statements and manipulate the underlying database.
Affected products
- MCMS MCMS 6.2.0 and earlier
Timeline
- 2026-08-26: disclosed