OFCMS vulnerabilities

In OFCMS 1.1.3, the Query function in SysUserController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was found in OFCMS 1.1.3 in the JSON Query interface in SystemParamController.java. The Query function allows SQL injection. The attack can be performed remotely and the exploit has been published.

In OFCMS 1.1.3, the Query function in SystemDictController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was found in OFCMS up to version 1.1.3 in the file ComnController.java. The Query function with argument system.user.query allows SQL injection. The attack can be performed remotely and the exploit has been published.