A flaw in the Query function of OFCMS’s ComnController.java allows an attacker to manipulate the system.user.query argument, enabling SQL injection. The affected code does not properly sanitize input, resulting in the ability to inject arbitrary SQL statements. This vulnerability can compromise database confidentiality and integrity by allowing attackers to read, modify, or delete data.

The issue affects any deployment of OFCMS versions up to and including 1.1.3. The vulnerable code resides in the admin controller layer of the application, which is reachable through the public web interface unless further protected.

The CVSS score of 5.3 suggests moderate severity. The EPSS score is not available, but public exploit code has already been released, indicating that the vulnerability is actively exploited. The flaw is remotely exploitable via HTTP requests to the admin controller, and the vulnerability is not included in the CISA KEV catalogue. Attackers can gain unauthorized data access or disrupt database integrity from afar if the endpoint remains exposed.