CVE-2026-68000: SQL Injection
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist filtering, yet keywords like CREATE/TABLE/SET/PREPARE/EXECUTE are not included in the list, allowing for bypassing. Attackers can execute stacked SQL statements without logging in.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it through the public front-end category-list interface. No login is required.
What input is vulnerable, and why can the existing filtering be bypassed?
The size parameter is concatenated directly into a SQL LIMIT clause through FreeMarker ${size} rather than being parameterized and bound. The blacklist-based SqlInjectionUtil does not include keywords such as CREATE, TABLE, SET, PREPARE, or EXECUTE, enabling bypasses and stacked SQL statements.
Which MCMS versions are known to be affected?
MCMS versions up to and including 6.2.0 are identified as vulnerable.