QCMS EUVD-2026-83822

Requires network access to a QCMS (<=6.0.6) instance exposing the Content Detail Page, which is a public/frontend endpoint - no authentication (PR:N) or user interaction needed. The specific and unusual limiting condition: the application's router parses the raw REQUEST_URI without URL-decoding, so injection payloads MUST contain literal space characters - percent-encoding (%20) will not decode before route parsing and will break the payload. This forces attackers to deliver un-encoded spaces in the URI, which can be filtered or normalized by upstream proxies/CDNs/WAFs, adding practical exploitation friction. Beyond that, exploitation works against default configurations of the affected product.

This is a moderate-priority, unauthenticated SQL injection in an obscure product. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:L/VI:L/VA:L, E:P) yields 6.9 - network-reachable, low-complexity, no authentication or user interaction, which are genuine amplifiers. However, the vendor rated confidentiality/integrity/availability all as Low, understating typical SQLi impact: a working injection into the ID parameter usually enables full database dump (credential hashes, admin auth bypass), so I assess confidentiality High (my 3.1 ~7.5). Countervailing signals: exploitation status is a publicly available exploit code (SSVC/CVSS E:P, POC on GitHub) but NOT active exploitation - no CISA KEV entry and no EPSS score is supplied, so there is no evidence of widespread automated exploitation. A concrete technical LIMITER stated in the description materially raises real-world exploitation friction: the router consumes raw REQUEST_URI without URL decoding, so payloads must embed LITERAL spaces because %20 never decodes before route parsing - this constrains payload delivery through intermediaries/WAFs/proxies that normalize URLs. Net: real but not urgent - a valid unauth SQLi with public POC, tempered by an obscure deployment footprint and a payload-encoding constraint. Treat as a patch-when-available item rather than an emergency, noting the vendor responded to disclosure 'with profanity,' implying no fix is forthcoming.

A remote unauthenticated attacker requests a QCMS content-detail page and injects SQL through the ID argument handled by self_Tmp() in Lib/Config/Controllers.php, using literal-space-based payloads (no %20) to satisfy the raw-REQUEST_URI router. This lets them enumerate and dump the backend database, including administrator credential hashes. A public exploit is available (GitHub yukino06/CVE issue #1), lowering the skill barrier.