This vulnerability affects OFCMS versions 1.1.0 through 1.1.3 in the ComnController.java file, specifically in the Query function. An attacker can remotely manipulate the system.user.query parameter to perform SQL injection attacks. The vulnerability has been publicly disclosed and an exploit is available, but the vendor has not issued a patch or official remediation. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows an attacker to perform SQL injection via the system.user.query parameter, potentially leading to unauthorized data access or modification in the OFCMS database. The vulnerability is exploitable remotely without user interaction and has a medium severity rating. No confirmed exploits in the wild have been reported yet.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates and consider implementing temporary mitigations such as input validation or web application firewalls to detect and block suspicious queries targeting the system.user.query parameter. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.