This vulnerability exists in OFCMS 1.1.3 in the Query function of the SysUserController.java file, part of the JSON Query Interface. It allows remote attackers to perform SQL injection attacks by manipulating input to the Query function. The weakness could enable attackers to execute arbitrary SQL commands on the backend database. The vulnerability was responsibly disclosed early to the project, but no official fix or mitigation has been released. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow remote attackers to execute unauthorized SQL commands, potentially leading to unauthorized data disclosure, modification, or other database impacts. Given the medium CVSS score and low impact ratings, the severity is moderate. The public availability of exploit code increases the risk of exploitation, although no known active exploitation has been reported.

No official patch or remediation is currently available from the vendor. Since the project has not responded or provided a fix, users should consider implementing temporary mitigations such as input validation, parameterized queries, or restricting access to the vulnerable interface until an official fix is released. Monitor the vendor advisory for updates and apply any official patches promptly once available.