Description

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Router uses raw REQUEST_URI without URL decoding, so payloads must contain literal spaces - %20 never decodes before route parsing. The support team of the vendor was contacted early about this disclosure. Unfortunately, they responded just with profanity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-21T02:16:53.853Z",
  "pubdate": "2026-09-21T02:16:53.853Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in QCMS versions up to and including 6.0.6. The flaw exists within the self_Tmp function of the Content Detail Page component.\nThe vulnerability allows remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database by manipulating the ID parameter. Successful exploitation can lead to unauthorized data access, modification, or complete compromise of the database contents.\nThe risk is significantly elevated due to the public disclosure of a functional exploit. Furthermore, the application's routing mechanism processes the raw REQUEST_URI without performing necessary URL decoding, requiring attackers to use literal space characters in their payloads rather than URL-encoded variants (e.g., %20).\nGiven that the vendor has not provided a security patch and has demonstrated non-cooperation, immediate manual intervention or the implementation of compensating controls at the network level is required to mitigate the exposure.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient sanitization of the ID argument processed by the self_Tmp function located in Lib/Config/Controllers.php. The application logic directly incorporates user-supplied input from the REQUEST_URI into SQL queries without employing parameterized queries, prepared statements, or adequate input validation/escaping.\nThe vulnerability is compounded by the application's router behavior, which parses the REQUEST_URI in its raw, undecoded state. Standard web exploitation techniques utilizing URL-encoded characters, such as %20 for spaces, are ineffective because the routing layer does not decode these sequences before passing them to the controller. Consequently, malicious payloads must be crafted using literal spaces to bypass routing filters and reach the vulnerable function.\nThe attack flow begins with a remote, unauthenticated attacker sending a crafted HTTP request to the Content Detail Page. The request URI includes a malicious payload injected into the ID parameter. Because the router fails to decode the URI, the application proceeds to the self_Tmp function in Lib/Config/Controllers.php, where the unvalidated, raw input is concatenated directly into a database query string.\nThis manipulation allows the attacker to break out of the intended query context and append arbitrary SQL commands, such as UNION-based attacks or time-based blind SQL injection techniques, to exfiltrate database records, bypass authentication, or modify table structures.\nThe exposure is strictly remote, requiring no prior authentication or specific privilege level, making this a high-impact vulnerability. The post-exploitation impact includes full control over the database, potential administrative account takeover, and exposure of sensitive user or system information stored within the QCMS database. The lack of proper input handling at the controller level represents a fundamental failure in implementing secure coding practices against SQL injection vectors."
}