SQL Injection in MCMS Custom Model Import Feature

Executive Summary

CVE-2026-88416 is an SQL injection vulnerability in MCMS versions 6.1.1 through 6.2.1. It affects the custom model/form import feature where the `modelJson.sql` parameter is passed directly to `JdbcTemplate.execute()` without sanitization. Attackers can inject malicious SQL commands through this parameter.

Useful 0 Not Useful 0

Detection Guidance

Check MCMS logs for suspicious requests to the /ms/mdiy/form/importJson.do endpoint containing modelJson.sql parameters with SQL commands. Monitor for unusual database queries or data exfiltration attempts via /ms/mdiy/form/data/queryData.do. Look for CREATE TABLE ... AS SELECT statements or other bypass attempts in SQL injection filters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary SQL commands. They can read sensitive data like database names, table names, column names, and admin credentials. Attackers can also modify or delete data, leading to data breaches, unauthorized access, or system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access and exposure of sensitive data, violating GDPR and HIPAA requirements. Organizations may face legal penalties, fines, and reputational damage due to non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the custom model/form import feature in MCMS if not needed. Apply input validation to block executable SQL in modelJson.sql parameters. Restrict raw SQL execution permissions and enforce least-privilege access. Update MCMS to a patched version if available. Monitor database activity for unauthorized queries.

Useful 0 Not Useful 0