SQL Injection Vulnerability in QCMS Content Detail Page

A critical SQL injection vulnerability has been identified in QCMS versions up to 6.0.6. The flaw resides in the self_Tmp function within the file Lib/Config/Controllers.php, which handles the Content Detail Page component. Attackers can exploit this via a remote, unauthenticated request by injecting malicious SQL code into the ID argument.

Defenders should note that the QCMS router does not perform URL decoding on the incoming REQUEST_URI before routing occurs. Consequently, exploit payloads must be crafted using literal spaces rather than URL-encoded entities (like %20), as the latter are not interpreted correctly by the routing logic. This vulnerability was disclosed publicly, and given the lack of a vendor patch, organizations utilizing QCMS must implement compensating controls at the network perimeter or application firewall level to inspect and sanitize the ID parameter in incoming requests to the Content Detail Page.

Impact

Successful exploitation allows remote attackers to execute arbitrary SQL commands against the backend database. This may lead to unauthorized data exfiltration, modification of application content, or potential full database compromise. As the vulnerability is publicly disclosed and exploitable remotely, the risk to public-facing QCMS deployments is high.

Recommendation

• Deploy Web Application Firewall (WAF) rules to detect and block requests to the Content Detail Page containing SQL injection patterns in the ID parameter.
• Implement strict input validation for the ID parameter in the application front-end or via a reverse proxy to ensure it conforms to expected alphanumeric formats.
• Monitor web server access logs for anomalous requests containing literal space characters within query strings targeting the identified path.