The vulnerability in OFCMS allows an attacker to inject arbitrary SQL through the JSON query endpoint exposed in the SystemDictController. This flaw corresponds to CWE-74 and CWE-89. The input is constructed in the Query function without proper sanitization, enabling execution of arbitrary statements on the backend database. A successful exploitation would allow the attacker to read, modify or delete data stored in the database, compromising confidentiality, integrity and potentially availability of the system.

The affected system is OFCMS version 1.1.3. The flaw resides in the SystemDictController class located under the /ofcms-admin/src/main/java/com/ofsoft/cms/admin/controller/system/ directory, specifically the Query method handling JSON requests. Users deploying this version of OFCMS without a fix are therefore exposed to the risk.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available, so the current model does not provide a specific estimate of exploitation probability. The vulnerability is not listed in the CISA KEV catalog and the vendor has not yet provided a public fix. Exploitation can be performed remotely by sending a crafted JSON payload to the exposed endpoint, and publicly available proof‑of‑concept code suggests the attack could be automated. Until the vendor issues a patch, the likely attack vector remains the remote JSON query interface.