CVE-2026-4234: SSCMS DDL SitesAddController.Submit.cs sql injection

Published Mar 16, 2026

Updated

A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

sscms SSCMS

Event History

Mar 16, 2026

CVE Published

via MITRE·10:32 AM

Data Sourced

via MITRE·10:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:20 PM

DescriptionSeverityWeakness

Oct 8, 58191

Event

via FIRST·09:16 PM

Frequently Asked Questions

What is the severity of CVE-2026-4234?

CVE-2026-4234 is classified with a high severity due to the potential for SQL injection attacks.

How do I fix CVE-2026-4234?

To fix CVE-2026-4234, ensure that input sanitization is implemented for the vulnerable parameter in SitesAddController.Submit.cs.

What types of attacks could exploit CVE-2026-4234?

CVE-2026-4234 can be exploited through SQL injection, allowing attackers to manipulate database queries.

Which versions of SSCMS are affected by CVE-2026-4234?

CVE-2026-4234 affects SSCMS version 7.4.0 and potentially earlier versions.

What component of SSCMS does CVE-2026-4234 affect?

CVE-2026-4234 affects the SitesAddController.Submit.cs component of SSCMS.