PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10202 OFCMS CVE debrief

A SQL injection vulnerability exists in OFCMS 1.1.3 within the Query function of SystemDictController.java, affecting the JSON Query Interface. The vulnerability allows remote attackers to manipulate SQL queries through the affected component. The issue was reported to the project maintainers via Gitee but had not received a response at the time of CVE publication. The exploit is publicly available, though the CVSS 4.0 base score of 2.1 reflects LOW severity, with network attack vector, low attack complexity, and required privileges. The weakness is categorized under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Vendor
OFCMS
Product
OFCMS 1.1.3
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-06-01
Advisory published
2026-06-01
Advisory updated
2026-06-01

Who should care

Organizations running OFCMS 1.1.3 instances with exposed administrative interfaces; security teams monitoring for SQL injection in Java-based CMS platforms; developers maintaining OFCMS forks or deployments

Technical summary

The vulnerability resides in the Query method of SystemDictController.java within OFCMS 1.1.3's administrative module. Insufficient input sanitization in the JSON Query Interface permits SQL injection, enabling remote attackers with low privileges to manipulate backend database queries. The attack requires network access but no user interaction. Public exploit availability increases practical risk despite the LOW CVSS base score. The project was notified through a Gitee issue report prior to CVE publication without confirmed response.

Defensive priority

moderate

Recommended defensive actions

  • Review and restrict access to the OFCMS JSON Query Interface, particularly the /ofcms-admin/src/main/java/com/ofsoft/cms/admin/controller/system/SystemDictController.java Query function
  • Implement parameterized queries or prepared statements to replace dynamic SQL construction in the affected component
  • Apply input validation and sanitization for all user-supplied data processed by the JSON Query Interface
  • Monitor for unauthorized database query patterns or unexpected table access attempts
  • Contact OFCMS project maintainers via available channels to verify patch status and coordinate remediation
  • Consider network segmentation or WAF rules to limit exposure of administrative interfaces if immediate patching is not available

Evidence notes

Vulnerability description sourced from NVD entry with VulDB as CNA. Affected file path and function name derived from official CVE description. Vendor contact attempt documented via Gitee issue reference. CVSS 4.0 vector and score from NVD metadata. No patch or vendor response confirmed at time of disclosure.

Official resources

2026-06-01