CVE-2026-68000: n/a

CVE-2026-68000 describes a critical SQL injection vulnerability in MCMS <=6.2.0. The 'size' parameter in the /cms/category/list endpoint is injected directly into the SQL LIMIT clause using FreeMarker's ${size} expression without parameter binding. The built-in SqlInjectionUtil attempts to filter malicious input using a regex blacklist but fails to include keywords such as CREATE, TABLE, SET, PREPARE, and EXECUTE. This omission enables attackers to bypass the blacklist and execute multiple stacked SQL statements remotely without requiring login.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands on the backend database. This can lead to full compromise of the database confidentiality, integrity, and availability, including data leakage, modification, or destruction. The CVSS score of 9.8 reflects the critical severity and the potential for complete system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider implementing web application firewall rules to block suspicious input patterns related to SQL injection targeting the 'size' parameter.