EUVD-2026-66702
GHSA-rqmc-ggwg-7wvr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable front-end endpoint, low-complexity injection, and stacked queries permit full database read plus modification/destruction, so PR:N and C/I/A all High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist filtering, yet keywords like CREATE/TABLE/SET/PREPARE/EXECUTE are not included in the list, allowing for bypassing. Attackers can execute stacked SQL statements without logging in.
AnalysisAI
Unauthenticated SQL injection in Mingsoft MCMS versions 6.2.0 and earlier lets remote attackers inject arbitrary SQL through the size parameter of the front-end /cms/category/list endpoint. The parameter is rendered directly into the query's LIMIT clause via the FreeMarker expression ${size} without parameter binding, and the built-in SqlInjectionUtil blacklist omits CREATE/TABLE/SET/PREPARE/EXECUTE, so its filter is bypassable and stacked queries execute. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the MCMS front-end /cms/category/list endpoint on a vulnerable instance (<=6.2.0) with the front-end interface exposed; no authentication, no user interaction, and no non-default configuration are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is consistent with an unauthenticated, network-reachable, low-complexity injection on a front-end endpoint, and stacked-query capability supports the high integrity/availability impact (data modification, table creation/drops). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the available data, so upgrade to a fixed MCMS build once Mingsoft publishes one and monitor the project's official channels. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Mingsoft MCMS 6.2.0 and earlier instances exposing the /cms/category/list endpoint to external networks, as publicly available exploit code exists. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today