Description

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T05:16:59.173Z",
  "pubdate": "2026-10-12T05:16:59.173Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the Password Recovery Mail Endpoint of jackq XCMS, specifically within the PublicController::sendFindPwdMail function.\nThis vulnerability exists in versions up to commit hash 3fab5342cc509945a7ce1b8ec39d19f701b89261.\nThe flaw stems from improper sanitization of the email parameter, allowing remote attackers to inject arbitrary SQL commands into database queries.\nThe risk is high, as the vulnerability is remotely exploitable without authentication, potentially leading to unauthorized data exfiltration, database modification, or full compromise of the application's backend database.\nThe exploit is publicly disclosed, increasing the likelihood of active exploitation attempts against vulnerable installations.",
  "technicalDetails": "The vulnerability resides in the PublicController::sendFindPwdMail function located in Admin/Home/Controller/PublicController.class.php.\nThe root cause is the failure to properly validate or sanitize the 'email' input parameter before incorporating it into a database query. This lack of input validation allows an attacker to break the context of the intended SQL statement and inject malicious SQL syntax.\nThe attack flow begins with a remote, unauthenticated attacker sending a crafted HTTP request to the Password Recovery Mail endpoint. By manipulating the 'email' argument, the attacker can supply specially crafted strings that escape the data boundary of the query.\nBecause the input is processed server-side in a database interaction, the database engine executes the injected SQL commands with the privileges of the database user configured for the XCMS application.\nSuccessful exploitation permits the attacker to alter the query logic to retrieve sensitive data from other tables, bypass authentication mechanisms, or perform administrative operations on the underlying database management system.\nThe vulnerable code section fails to utilize prepared statements or parameterized queries, which are essential for separating executable code from user-supplied data. Consequently, the application remains susceptible to standard SQL injection techniques, including union-based, error-based, or blind SQL injection vectors depending on how the application handles query results.\nPost-exploitation impact includes complete confidentiality loss of stored data, potential integrity loss through unauthorized data manipulation, and in some configurations, potential remote command execution if the database permissions allow for file system interactions or administrative stored procedures."
}