SQL Injection in jackq XCMS Password Recovery

A critical SQL injection vulnerability has been identified in jackq XCMS, affecting versions up to the commit hash 3fab5342cc509945a7ce1b8ec39d19f701b89261. The flaw resides within the PublicController::sendFindPwdMail function located in Admin/Home/Controller/PublicController.class.php. This function incorrectly handles the email argument during the password recovery process, enabling remote attackers to inject malicious SQL commands. Because this vulnerability is exposed through the password recovery endpoint, it does not require prior authentication, significantly increasing the risk of unauthorized database access, data exfiltration, or modification. An exploit has been publicly disclosed, making it highly likely that malicious actors will attempt to weaponize this endpoint in the near future.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to perform arbitrary operations on the application database. This can lead to full database compromise, unauthorized administrative access, or the theft of sensitive user information. Given that this component is a core part of the account management system, defenders should prioritize patching or restricting access to the password recovery endpoint until a fix is deployed.

Recommendation

• Immediately audit web logs for HTTP requests directed to the password recovery endpoint containing SQL injection patterns such as OR 1=1, UNION SELECT, or stacked queries.
• Implement input validation and parameterized queries for the email parameter in the Admin/Home/Controller/PublicController.class.php component.
• Monitor web application firewall (WAF) logs for blocks related to SQL injection signatures targeting the XCMS password recovery controller.