QCMS is vulnerable to an unauthenticated SQL injection attack that allows remote adversaries to extract sensitive database information.

The flaw resides in the self_Tmp function within Lib/Config/Controllers.php, where the ID parameter is concatenated directly into SQL queries without proper sanitization. Because the application router uses raw REQUEST_URI strings without decoding, an unauthenticated attacker can supply crafted payloads to perform unauthorized database operations.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, potentially exposing sensitive information such as user credentials, password hashes, and system configuration data. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, particularly for organizations relying on QCMS for content management.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected Content Detail Page or implement strict input validation on the ID parameter at the web server level.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL keywords or unusual URL encoding patterns, and monitor database logs for unexpected query execution errors.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns specifically targeting the ID parameter in URL paths.

Public Exploit Available: Yes, a technical write-up containing attack details is available via the referenced GitHub issue.

Given the public availability of technical details regarding this SQL injection flaw, immediate action is required to harden the environment. Organizations using QCMS should prioritize implementing WAF filtering or access restrictions until a formal security update is provided by the vendor.