CVE-2026-7435
SQL Injection in SSCMS via Unsanitized stl:sqlContent Query
Publication date: 2026-04-30
Last updated on: 2026-05-04
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sscms | sscms | 7.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in SSCMS v7.4.0 is a SQL injection issue found in the stl:sqlContent tag. Specifically, the queryString attribute is used directly in database queries without proper parameterization or sanitization. This allows attackers to send specially crafted encrypted payloads to the /api/stl/actions/dynamic endpoint, which can then execute arbitrary SQL commands on the database.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to the database, disclosure of sensitive data, bypassing authentication mechanisms, modification of data, or even complete compromise of the database.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in SSCMS v7.4.0 can lead to unauthorized database access, data disclosure, authentication bypass, data modification, or complete database compromise.
Such impacts can result in violations of data protection regulations and standards like GDPR and HIPAA, which require the protection of sensitive personal and health information from unauthorized access and breaches.
Therefore, exploitation of this vulnerability could compromise compliance with these regulations due to potential data breaches and unauthorized data manipulation.