OpenKM 6.3.12 contains an unrestricted SQL execution flaw that permits authenticated administrative users to inject and run arbitrary SQL statements through the qs parameter on the /admin/DatabaseQuery endpoint. When exploited, an attacker can read sensitive information such as usernames and password hashes from the OKM_USER table, alter user permissions, or delete critical database records. This vulnerability is identified as a CWE‑89 SQL Injection and is rated with a CVSS score of 8.6, indicating high severity.

The flaw affects OpenKM Community Edition and OpenKM Professional Edition running version 6.3.12. Any installation of these products that exposes the /admin/DatabaseQuery interface to authenticated administrators is vulnerable; this includes standard deployments and Docker images from the official repository.

With a CVSS score of 8.6 the vulnerability is considered high risk, yet the attack vector requires existing admin authentication, limiting initial access to users with privileged credentials. The EPSS score is not available and the issue is not listed in CISA's KEV catalog, but the potential for data compromise and database tampering remains significant once the vulnerability is accessed.