📄 Description (English)
A security flaw has been discovered in OFCMS up to 1.1.3. The impacted element is the function Query of the file ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\ComnController.java of the component ComnController. Performing a manipulation of the argument system.user.query results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
🤖 AI Executive Summary
CVE-2026-10193 is a SQL injection vulnerability in OFCMS versions up to 1.1.3 affecting the ComnController Query function. An attacker can manipulate the 'system.user.query' parameter to execute arbitrary SQL commands remotely. With a CVSS score of 6.3 and public exploit availability, this poses a moderate risk to organizations using OFCMS for content management, particularly those handling sensitive user data.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 31, 2026 21:01
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability primarily impacts Saudi government agencies, municipalities, and private sector organizations using OFCMS for content management systems. High-risk sectors include: Government (NCA, CITC) for administrative portals; Banking sector for customer-facing CMS platforms; Healthcare institutions using OFCMS for patient information systems; Telecommunications companies (STC, Mobily) for customer portals; and Educational institutions. The SQL injection could lead to unauthorized access to user databases, credential theft, and potential lateral movement within organizational networks.
🏢 Affected Saudi Sectors
Government
Banking
Healthcare
Telecommunications
Education
Energy
Retail
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
6.8
/ 10.0
🔧 Remediation Steps (English)
Immediate Actions:
1. Identify all systems running OFCMS versions up to 1.1.3 across your infrastructure
2. Isolate affected systems from production networks if possible or implement network segmentation
3. Review access logs for suspicious SQL patterns in ComnController Query function parameters
4. Monitor for indicators of compromise: unusual database queries, failed authentication attempts, data exfiltration
Patching Guidance:
1. Contact OFCMS vendor immediately for security patch availability
2. If patch unavailable, upgrade to latest OFCMS version when available
3. Implement Web Application Firewall (WAF) rules to block SQL injection patterns in system.user.query parameter
4. Apply input validation: whitelist allowed characters, implement parameterized queries
Compensating Controls:
1. Implement database activity monitoring (DAM) to detect anomalous SQL execution
2. Apply principle of least privilege to database service accounts
3. Enable SQL query logging and audit trails
4. Implement rate limiting on ComnController endpoints
5. Deploy IDS/IPS signatures for SQL injection detection
Detection Rules:
1. Monitor for SQL keywords (UNION, SELECT, DROP, INSERT, UPDATE) in system.user.query parameters
2. Alert on multiple failed database queries from application layer
3. Track unusual database connection patterns from OFCMS application user
4. Monitor for encoded SQL injection attempts (hex, URL encoding, Unicode)
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تحديد جميع الأنظمة التي تعمل بـ OFCMS الإصدارات حتى 1.1.3 عبر البنية التحتية
2. عزل الأنظمة المتأثرة عن شبكات الإنتاج إن أمكن أو تطبيق تقسيم الشبكة
3. مراجعة سجلات الوصول للأنماط المريبة في معاملات دالة Query في ComnController
4. المراقبة للمؤشرات: استعلامات قاعدة البيانات غير العادية، محاولات المصادقة الفاشلة، تسرب البيانات
إرشادات التصحيح:
1. الاتصال بمورد OFCMS فوراً للحصول على تصحيح أمني
2. إذا لم يكن التصحيح متاحاً، قم بالترقية إلى أحدث إصدار OFCMS عند توفره
3. تطبيق قواعد جدار حماية تطبيقات الويب (WAF) لحجب أنماط حقن SQL في معامل system.user.query
4. تطبيق التحقق من الإدخال: قائمة بيضاء للأحرف المسموحة، تطبيق الاستعلامات المعاملة
الضوابط البديلة:
1. تطبيق مراقبة نشاط قاعدة البيانات (DAM) للكشف عن تنفيذ SQL غير طبيعي
2. تطبيق مبدأ أقل امتياز على حسابات خدمة قاعدة البيانات
3. تفعيل تسجيل استعلامات SQL ومسارات التدقيق
4. تطبيق تحديد معدل على نقاط نهاية ComnController
5. نشر توقيعات IDS/IPS للكشف عن حقن SQL
قواعد الكشف:
1. مراقبة كلمات مفتاحية SQL (UNION, SELECT, DROP, INSERT, UPDATE) في معاملات system.user.query
2. التنبيه على استعلامات قاعدة بيانات متعددة فاشلة من طبقة التطبيق
3. تتبع أنماط اتصال قاعدة البيانات غير العادية من مستخدم تطبيق OFCMS
4. مراقبة محاولات حقن SQL المشفرة (hex, URL encoding, Unicode)
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.14.2.1 - Information security requirements in supplier relationships
ECC 2024 A.14.2.5 - Addressing information security in supplier agreements
ECC 2024 A.12.6.1 - Management of technical vulnerabilities
ECC 2024 A.12.2.1 - Secure development policy
🔵 SAMA CSF
SAMA CSF ID.GV-1 - Organizational governance and risk management
SAMA CSF PR.DS-6 - Data is protected from unauthorized access
SAMA CSF DE.CM-1 - The network is monitored to detect potential cybersecurity events
SAMA CSF RS.MI-2 - Incidents are mitigated
🟡 ISO 27001:2022
ISO 27001:2022 A.8.1 - Organizational controls for information security
ISO 27001:2022 A.12.2.1 - Secure development policy and procedures
ISO 27001:2022 A.12.6.1 - Management of technical vulnerabilities
ISO 27001:2022 A.14.2.1 - Supplier security requirements
🟣 PCI DSS v4.0.1
PCI DSS 6.2 - Ensure all system components and software are protected from known vulnerabilities
PCI DSS 6.5.1 - Injection flaws prevention
PCI DSS 11.2 - Vulnerability scanning and management