CVE-2026-42425

Vulnerability

OpenKM 6.3.12 (Community Edition) and 7.1.47 (Pro Edition) and previous versions contain an unrestricted SQL execution vulnerability in the /admin/DatabaseQuery endpoint [1][2][3]. Authenticated administrative users can supply arbitrary SQL statements through the qs parameter [1]. This allows the execution of any SQL command against the application database [3]. The vulnerability is present in the administrative interface and does not require any special configuration beyond default admin privileges [1].

Exploitation

An attacker needs valid administrative credentials to access the /admin/DatabaseQuery interface [1][3]. Using the qs parameter, they can craft SQL queries to extract, modify, or delete database records [1][2]. For example, a query can retrieve usernames and password hashes from the OKM_USER table [1]. The exploit can be performed via a simple HTTP POST request with the malicious SQL payload [1]. No additional user interaction or race condition is required [1][3].

Impact

Successful exploitation leads to full compromise of the database [3]. An attacker can extract sensitive information including usernames and password hashes, modify permissions, and delete records [1][3]. This can be chained with other vulnerabilities (e.g., RCE via BeanShell) to achieve complete system takeover [2][3]. The impact is severe as the database contains all application data, including documents metadata and user credentials [3].

Mitigation

As of the publication date, no official vendor patch is available [3]. Affected versions include OpenKM Community Edition 6.3.12 and OpenKM Pro Edition 7.1.47 and earlier [1][2]. Until a fix is released, organizations should restrict access to administrative interfaces via network segmentation, enforce strong authentication, and monitor logs for suspicious SQL queries [3]. The vendor's website (openkm.com) provides general contact information but no security advisory [4].