CVE-2026-94110: QCMS Content Detail Controllers.php self_Tmp sql injection
A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Router uses raw REQUESTURI without URL decoding, so payloads must contain literal spaces - %20 never decodes before route parsing. The support team of the vendor was contacted early about this disclosure. Unfortunately, they responded just with profanity.
Affected Software
Event History
Frequently Asked Questions
Which QCMS deployments should be considered exposed?
QCMS versions up to and including 6.0.6 are affected where the Content Detail Page reaches the self_Tmp function in Lib/Config/Controllers.php.
Does exploitation require authentication or user interaction?
No. The issue is remotely exploitable with no privileges or user interaction required, and the attack complexity is rated low.
Are there payload-handling details that affect exploitation attempts?
Yes. Route parsing uses the raw REQUEST_URI without URL decoding, so encoded spaces such as %20 do not decode before parsing. Payloads must contain literal spaces.
How urgent is triage if the system is internet-accessible?
A public exploit has been disclosed and may be used. Internet-accessible instances in the affected version range should be prioritized for assessment.