Description

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-09T14:17:26.763Z",
  "pubdate": "2026-08-09T14:17:26.763Z",
  "executiveSummary": "A security vulnerability has been identified in MingSoft MCMS up to version 3.0.6, specifically within the ms-mdiy component. The flaw manifests as an SQL injection vulnerability located in the ModelDataImpl.queryDiyFormData function accessible via the endpoint /mdiy/form/data/list.do. This vulnerability allows remote, unauthenticated attackers to manipulate the formFields argument, thereby injecting arbitrary SQL commands into database queries executed by the application.\nThe impact of successful exploitation includes unauthorized access to sensitive backend database contents, potential data tampering, and compromise of the underlying database server depending on database privileges. The attack vector is fully remote and does not require prior authentication, presenting a high risk to deployments of the affected software. Public disclosure of the exploit increases the likelihood of active exploitation in the wild, compounded by the vendor's lack of response to early vulnerability disclosures.",
  "technicalDetails": "The vulnerability resides in the ms-mdiy component of MingSoft MCMS up to version 3.0.6. The root cause stems from improper neutralization of user-supplied input within the ModelDataImpl.queryDiyFormData function. When processing requests sent to the /mdiy/form/data/list.do URI, the application directly incorporates the formFields parameter into dynamic SQL query construction without adequate parameterization, sanitization, or validation.\nThe attack flow proceeds as follows: an attacker crafts a malicious HTTP request targeting the vulnerable endpoint /mdiy/form/data/list.do. Within this request, the formFields argument is injected with SQL syntax constructs designed to alter the logical structure of the database query executed by the ModelDataImpl.queryDiyFormData method. Because the application trusts and concatenates the input directly into the SQL execution context, the database engine interprets the malicious payload as executable database commands.\nNetwork exposure for this vulnerability is remote, as the endpoint is accessible over the network without requiring any pre-existing user session or administrative privileges. Post-exploitation impact varies based on the database user permissions but generally permits data exfiltration, modification, or deletion of application data, potentially leading to full compromise of the database management system."
}