MCMS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mcms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 09 Aug 2026 15:46:47 +0000SQL Injection Vulnerability in MingSoft MCMShttps://feed.craftedsignal.io/briefs/2026-08-mingsoft-mcms-sqli/Sun, 09 Aug 2026 15:46:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-mingsoft-mcms-sqli/MingSoft MCMS versions up to 3.0.6 contain a remote SQL injection vulnerability in the ms-mdiy component, allowing unauthenticated attackers to manipulate the formFields argument to execute arbitrary database queries.MingSoft MCMS (versions up to 3.0.6) is susceptible to a critical SQL injection vulnerability identified as CVE-2026-19355. The vulnerability resides within the ModelDataImpl.queryDiyFormData function of the ms-mdiy component. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request to the /mdiy/form/data/list.do endpoint, specifically injecting malicious SQL syntax into the 'formFields' argument. Successful exploitation enables unauthorized data extraction or modification within the underlying database. The vendor has been unresponsive to disclosure efforts, and proof-of-concept exploitation material is publicly available. Defenders should prioritize auditing traffic to the identified endpoint for anomalous SQL keywords or malformed input parameters.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass authentication controls and execute arbitrary SQL commands. Depending on the database permissions of the MCMS application, this could lead to full database compromise, exfiltration of sensitive site data, or potential modification of administrative records, resulting in total loss of application integrity.

Recommendation

  • Monitor web application logs for HTTP requests directed at /mdiy/form/data/list.do that contain SQL control characters (e.g., single quotes, comments, UNION, SELECT) within the formFields parameter.
  • Deploy web application firewall (WAF) signatures designed to detect and block SQL injection attempts targeting the listed endpoint.
  • Restrict access to the MCMS administrative and data-processing endpoints to trusted IP ranges until a patch is applied by the vendor or internal remediation is implemented.
  • Evaluate the application's database user permissions to ensure they follow the principle of least privilege, minimizing the blast radius in the event of successful injection.
]]>highadvisoryweb-vulnerabilitysqlivulnerability-management