SSCMS CVE-2026-7435

Requires high-privilege administrator access to SSCMS (CVSS PR:H). Attackers must possess valid credentials for an administrative account with permissions to interact with the /api/stl/actions/dynamic endpoint and utilize the stl:sqlContent template tag. The vulnerability affects network-accessible SSCMS installations (AV:N) without requiring additional non-default configurations. Exploitation does not require user interaction (UI:N) once administrative access is obtained. The primary limiting factor is the authentication requirement - this is not remotely exploitable against default configurations without prior credential compromise through separate attack vectors such as phishing, credential stuffing, insider threats, or chained exploits targeting authentication mechanisms.

Real-world risk is moderate despite the 7.2 CVSS score. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity but critically requires high privileges (PR:H), meaning attackers must already possess administrative credentials. This significantly reduces the attack surface compared to unauthenticated SQLi vulnerabilities. The attack is not automatable at scale (SSVC) because it requires prior credential compromise. No CISA KEV listing suggests this is not being exploited in widespread campaigns. However, the technical impact is severe (confidentiality, integrity, availability all high) - successful exploitation grants complete database control. The VulnCheck advisory provides detailed technical context that could facilitate POC development. Priority should be HIGH for organizations running SSCMS with multiple administrators or untrusted high-privilege accounts, MEDIUM for tightly controlled single-admin deployments. The authentication requirement is a limiting factor but not a defense - insider threats, credential stuffing, or chained exploits make this a real risk.

An attacker who has compromised administrator credentials (via phishing, credential reuse, or insider access) logs into the SSCMS administrative interface. They craft a malicious encrypted payload containing SQL injection code targeting the queryString attribute of the stl:sqlContent tag and submit it to the /api/stl/actions/dynamic endpoint. The unparameterized query executes attacker-controlled SQL statements, enabling them to extract password hashes for all users, modify content to inject malicious scripts, create new administrative backdoor accounts, or exfiltrate sensitive data stored in the CMS database.