This vulnerability in OFCMS 1.1.3 arises from improper input handling in the Query function within the JSON Query Interface, located in the SystemParamController.java file. It enables remote attackers to perform SQL injection attacks by manipulating the input to the affected function. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The project has been notified but has not provided a fix or mitigation guidance. Exploit code is publicly available, which may facilitate attacks.

Successful exploitation of this vulnerability can lead to unauthorized SQL queries being executed on the OFCMS backend database. This could result in data leakage, data modification, or other impacts typical of SQL injection attacks. However, the CVSS vector indicates low confidentiality, integrity, and availability impacts, suggesting limited but non-negligible consequences. Since the exploit is public, the risk of attack is elevated despite no known exploits in the wild at this time.

No official fix or patch is currently available from the vendor. Users should monitor the OFCMS project for updates or advisories. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the affected endpoint. Review and restrict access to the JSON Query Interface if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.