The vulnerability is located in the Query function of SysUserController.java in OFCMS 1.1.3. It arises from unsanitized input that is directly incorporated into an SQL statement, leading to SQL injection. An attacker can exploit the flaw remotely via the JSON Query interface, potentially reading, modifying, or deleting sensitive data from the underlying database. The weakness corresponds to CWE‑74 and CWE‑89 and poses a risk of confidentiality and integrity compromise.

The affected product is OFCMS version 1.1.3. No other versions are listed in the CNA data. The vulnerability has been identified only for this specific release within the OFCMS component named JSON Query Interface.

The CVSS score of 5.3 indicates a moderate severity level. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation in the wild at the time of analysis. The attack vector is inferred to be remote, as the issue description explicitly states remote initiation. With public exploit code reported, the risk level remains moderate but should be addressed promptly to reduce the potential for attackers to gain unauthorized database access.