Sscms EUVD-2026-12401

This vulnerability presents elevated real-world risk despite a moderate CVSS v3.1 score of 6.3. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network-accessible exploitation requiring only low privileges (authenticated user) with low attack complexity, suggesting practical exploitability. The EPSS exploitation probability is flagged as present (E:P in vector), indicating active exploitation likelihood. Most critically, a public proof-of-concept exploit is available and publicly disclosed via references (yuque.com link), dramatically increasing real-world risk. The vendor's failure to respond to early disclosure (RL:X - unknown remediation level) and unconfirmed patch status further elevate priority. The SSVC decision framework supports immediate action: exploitability is confirmed (public POC), attack is automatable (SQL injection), and technical impact is significant (confidentiality, integrity, and availability all affected). This is NOT a low-risk high-CVSS issue; the combination of public POC, vendor non-responsiveness, and authenticated but low-barrier access makes this a genuine operational priority.

An authenticated user (which could be a low-privilege content editor or compromised account) submits a crafted HTTP request to the SitesAddController.Submit endpoint with a malicious SQL payload embedded in the tableHandWrite parameter, such as tableHandWrite=myTable'; DROP TABLE users; --. Since the DDL Handler concatenates this unsanitized input directly into a SQL CREATE/ALTER statement without parameterization, the injected DROP TABLE command executes with the database service's privilege level, destroying the users table or exfiltrating sensitive data. A public proof-of-concept (available via the yuque.com reference) demonstrates this attack, making it reproducible by any attacker with SSCMS access or ability to obtain valid credentials.