Description
A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Patch ASAP
AI Analysis

Impact

A flaw in SSCMS 7.4.0 allows attackers to inject arbitrary SQL code through the tableHandWrite parameter in SitesAddController.Submit.cs, exploiting CWE‑89 and CWE‑74 weaknesses. If this vulnerability is triggered, the attacker can read, modify or delete data from the database, compromising the confidentiality, integrity, and possibly the availability of the application.

Affected Systems

The vulnerability impacts the SSCMS web content management system, specifically the DDL Handler component in the SitesAddController.Submit.cs file. Only the 7.4.0 release is known to be affected; newer or older versions may not be vulnerable.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in normal circumstances. The flaw is exploitable remotely and has already been released to the public, so an attacker could target any exposed instance. The vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation to date.

Generated by OpenCVE AI on March 22, 2026 at 15:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check if your SSCMS version is 7.4.0 or older, and upgrade to the latest release that contains the security fix.
  • Restrict external access to the SSCMS application using network firewall rules or VPN to limit who can reach the web interface.
  • Configure the database account used by SSCMS with the least privileges necessary, preferably read‑only or restricted write rights.
  • Implement a web application firewall or input validation rule to block suspicious SQL syntax in the tableHandWrite parameter.
  • Monitor application logs for abnormal database queries and investigate any anomalies promptly.

Generated by OpenCVE AI on March 22, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 16 Mar 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 11:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title SSCMS DDL SitesAddController.Submit.cs sql injection
First Time appeared Sscms
Sscms sscms
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sscms:sscms:*:*:*:*:*:*:*:*
Vendors & Products Sscms
Sscms sscms
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sscms Sscms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-16T12:42:12.620Z

Reserved: 2026-03-15T18:51:23.383Z

Link: CVE-2026-4234

cve-icon Vulnrichment

Updated: 2026-03-16T12:42:03.400Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-16T14:20:17.463

Modified: 2026-03-16T14:53:07.390

Link: CVE-2026-4234

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T07:02:52Z

Weaknesses