CVE-2026-108799 Details

A SQL injection vulnerability has been identified in the XCMS content management system, specifically in the password recovery mail endpoint of the admin console. This issue affects versions of XCMS prior to commit 3fab5342cc509945a7ce1b8ec39d19f701b89261. The vulnerability arises in the PublicController::sendFindPwdMail function, located in Admin/Home/Controller/PublicController.class.php. The endpoint is exposed without authentication, allowing unauthenticated remote attackers to manipulate the email parameter and execute SQL injection attacks. The injected SQL can be exploited to read sensitive data from the database, including administrator emails and password hashes, potentially leading to account takeover.

To address this vulnerability, update the AdminService::existAccount() method to use parameterized queries instead of concatenating user input into SQL strings. Implement server-side validation for the email parameter, add captcha and rate limiting to the password recovery endpoint, and ensure that the application's MySQL database privileges are configured securely.