Executive brief
QCMS is a content management system that displays detailed content pages. A SQL injection vulnerability in the content detail page allows unauthenticated attackers over the network to query the database directly, exposing sensitive data such as user password hashes and system configuration. The vulnerability requires no user interaction and can be exploited remotely by crafting malicious request parameters.
Technical details
The self_Tmp() method in Lib/Config/Controllers.php concatenates user-supplied ID parameters directly into SQL queries without proper parameterization or sanitization. The get_sql_cond() function in the database layer returns SQL conditions as raw strings without escaping. Exploitation is possible via network-based HTTP requests to the content detail page endpoint, with no authentication required.
Affected products
- QCMS up to 6.0.6
Timeline
- 2026-09-21: disclosed
- other: Exploit code publicly available