CVE-2026-108799: SQL Injection in XCMS Password Recovery Endpoint

Overview

A high-severity SQL injection vulnerability tracked as CVE-2026-108799 has been disclosed in jackq XCMS, an open-source PHP content management system. The flaw resides in the PublicController::sendFindPwdMail function inside Admin/Home/Controller/PublicController.class.php, which powers the application's password recovery mail endpoint.

Attackers can manipulate the email argument submitted to this endpoint to inject arbitrary SQL into the backend query without needing to authenticate first. Because password-recovery forms are, by design, exposed to unauthenticated visitors, this gives any remote attacker a pre-authentication path into the database layer. The vulnerability was reserved on October 11, 2026 and published on October 12, 2026, with the finding credited to researchers Wen Youwen and Wang Le of Guangzhou University, who submitted it through VulDB.

Technical Details

How It Works

XCMS follows a ThinkPHP-style MVC layout, where Admin/Home/Controller/PublicController.class.php handles public-facing (unauthenticated) requests, including the "forgot password" flow. The sendFindPwdMail function accepts an email argument — recorded by NVD as ema[il] — intended to look up the account associated with that address and send a recovery message.

The function builds its database lookup by concatenating this user-supplied value directly into a SQL statement rather than using parameterized queries or prepared statements. Because the endpoint sits ahead of any login check, an attacker never needs valid credentials to reach it — they only need network access to the application. By crafting the email field to include SQL metacharacters and clauses (e.g., UNION SELECT, boolean conditions, or time-based payloads), an attacker can alter the query's logic and extract data the function was never meant to return.

Attack Chain

1. Attacker identifies a publicly reachable XCMS instance exposing the password-recovery form (routed through PublicController).
2. Attacker submits the recovery request with the email parameter populated with SQL injection syntax instead of a valid address.
3. sendFindPwdMail() concatenates the unsanitized value directly into a SQL query executed against the backend database.
4. The attacker iterates boolean-based, UNION-based, or time-based blind injection techniques to confirm the injection point and map the schema.
5. Using the confirmed injection, the attacker extracts sensitive data — user emails, password hashes, session tokens, or administrator records.
6. With harvested administrator credentials, the attacker authenticates to the XCMS back end and escalates to broader application or server compromise.

Impact Assessment

Who Is at Risk

Any organization or individual running a jackq XCMS instance that is reachable from the internet and has not verified its codebase is newer than commit 3fab5342cc509945a7ce1b8ec39d19f701b89261 is at risk. This includes small businesses, agencies, and hobbyist sites using XCMS as a lightweight PHP CMS — a category of software that typically receives far less security scrutiny than larger platforms like WordPress or Drupal. Because the attack requires no authentication and no user interaction, exposure is purely a function of network reachability to the password-recovery form.

Recommendations

For System Administrators

1. Identify exposure — confirm whether any system runs jackq XCMS and determine its exact commit or release.
2. Update immediately if a fixed build newer than commit 3fab5342cc509945a7ce1b8ec39d19f701b89261 is available; verify the fix directly in sendFindPwdMail() if no formal advisory exists.
3. Restrict access to the password-recovery endpoint where feasible — rate-limit requests and place it behind a WAF rule tuned for SQL injection patterns targeting the email parameter.
4. Audit database users tied to the application and ensure the web application's DB account follows least-privilege (no unnecessary DROP, ALTER, or cross-schema access).

For Security Teams

1. Inventory scan — sweep external assets for XCMS fingerprints (admin paths, default branding, ThinkPHP-style directory structure).
2. Deploy detection signatures for SQL injection payloads (UNION SELECT, SLEEP(, boolean tautologies) submitted to password-recovery or findpwd-style routes.
3. Review logs for anomalous database errors or malformed email submissions on affected endpoints, and treat any match as a potential active exploitation attempt.
4. Prepare for credential rotation across affected deployments if historical logs suggest the endpoint was already probed before this disclosure.

For End Users

1. Change passwords on any service known to run XCMS, particularly if password recovery was ever used.
2. Enable multi-factor authentication wherever the platform supports it, to limit the damage of a stolen credential.
3. Watch for phishing that references this disclosure or impersonates password-reset notifications from affected sites.
4. Monitor account activity for unfamiliar logins or changes following the disclosure date.

Background

XCMS is an open-source PHP content management system maintained by developer jackq, structured around a ThinkPHP-style MVC convention — reflected in its Admin/Home/Controller directory layout. Like many small, community-maintained CMS projects, it lacks the dedicated security review pipeline that larger platforms benefit from, making injection flaws in rarely-audited code paths like password recovery a recurring theme.

This disclosure follows a broader pattern seen across smaller PHP CMS and admin-panel codebases throughout 2026 — including several SQL injection advisories in similarly scoped platforms previously covered on CosmicBytez Labs — where academic researchers and independent bug hunters have been systematically auditing self-hosted, low-popularity open-source software and reporting findings through aggregators such as VulDB rather than through a formal vendor security program.

Key Takeaways

1. CVE-2026-108799 is a CVSS 7.3 SQL injection in jackq XCMS's PublicController::sendFindPwdMail(), reachable through the password-recovery mail endpoint.
2. The flaw requires no authentication and no user interaction — only network access to the vulnerable form — making it attractive to opportunistic scanners.
3. A public proof-of-concept exploit already exists, though the vulnerability is not yet listed in CISA's KEV catalog.
4. No confirmed official patch beyond the referenced commit hash has been identified; administrators must verify their own codebase against it.
5. Successful exploitation can expose password hashes and user data, enabling follow-on account takeover and broader application compromise.
6. The disclosure reflects a wider trend of SQL injection findings in smaller, less-scrutinized open-source PHP CMS platforms during 2026.

Sources

• CVE-2026-108799 — NIST NVD
• CVE-2026-108799 in XCMS — VulDB
• CVE-2026-108799: XCMS Injection — Strix
• Proof-of-concept writeup — GitHub (wawyw/cve_report)