CVE-2026-2093

Executive Summary

CVE-2026-2093 is a critical SQL Injection vulnerability in Flowring's Docpedia document management platform. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL commands against the underlying database, potentially exfiltrating sensitive document metadata, user credentials, and business-critical content. With a CVSS score of 8.7 (High), the vulnerability is trivially exploitable over the network without authentication, and the vendor has released a hotfix (DP4 HotFix_057) that is recommended for immediate deployment. Organizations running Docpedia on internet-facing infrastructure are at elevated risk, particularly given the sensitive nature of data typically stored in document management systems.

Technical Analysis

The vulnerability resides in input validation logic within Docpedia's web application layer. Docpedia, developed by the Taiwan-based vendor Flowring, is a web-based document management system (DMS) widely deployed in enterprise environments across Asia-Pacific, particularly in government, healthcare, and financial sectors. The application exposes numerous HTTP endpoints for document retrieval, workflow management, and user authentication, several of which accept user-supplied parameters that are passed to database queries without proper sanitization or parameterization.

The SQL Injection vulnerability manifests when user-controlled input (e.g., query string parameters, POST body fields, or cookie values) is concatenated directly into SQL statements executed against the backend database (likely MySQL or MSSQL based on typical DMS deployments). Because the flaw exists in a pre-authentication code path, no session or token is required to trigger the vulnerability — a critical detail that elevates the severity substantially.

The attack surface is substantial: Docpedia typically listens on standard web ports (80, 443) and often features an IIS or Apache front-end. The application's URL structure commonly includes endpoints such as:

• /docpedia/API/document/search
• /docpedia/API/user/login
• /docpedia/index.php

The vulnerable parameter is likely a search/filter field or an ID-based lookup endpoint where the application builds queries dynamically. A typical vulnerable query might resemble:

SELECT * FROM documents WHERE title = '" + userInput + "' AND status = 1

Without parameterized queries or input escaping, an attacker can inject arbitrary SQL by closing the quote and appending malicious clauses, such as ' OR 1=1-- or error-based payloads like ' AND (SELECT 1 FROM (SELECT SLEEP(5))a)--.

The lack of CWE classification in the CVE record is notable, but based on the description — "allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents" — the vulnerability is definitively CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CVSS vector reflects a network-accessible, unauthenticated, low-complexity attack with high confidentiality impact. The scope change (S:C) indicates the vulnerability compromises components beyond the vulnerable application component, consistent with database-level access.

Exploitation Scenarios

While no public exploit exists as of this writing, the vulnerability class is well-understood and exploitable with standard SQL injection techniques. The following represents a realistic attack chain:

1) Reconnaissance and Target Identification: The attacker begins by identifying internet-facing Docpedia instances. Shodan or Censys queries using http.title:"Docpedia" or http.component:"Docpedia" reveal candidate targets. Alternatively, the attacker uses Google dorking (inurl:"docpedia") or scans a target IP range for HTTP services and fingerprints the Docpedia login page.

2) Fuzzing and Parameter Discovery: The attacker enumerates authenticated and unauthenticated endpoints. Common targets include:

• GET /docpedia/API/document/get?id=1
• POST /docpedia/API/search?keyword=test
• GET /docpedia/index.php?page=about

Automated tools like sqlmap (sqlmap -u "http://target/docpedia/API/document/get?id=1" --batch --level=5 --risk=3) are used to fingerprint injectable parameters. The tool identifies the database type (MySQL vs. MSSQL), confirms unauthenticated access, and extracts database schema.

3) Payload Construction and Execution: Once an injectable parameter is confirmed, the attacker crafts payloads to extract data. For a MySQL backend, a UNION-based injection might look like:

http://target/docpedia/API/document/get?id=1 UNION SELECT 1,username,password,4,5,6 FROM users--

Alternatively, for time-based blind injection (if error messages are suppressed):

http://target/docpedia/API/document/get?id=1 AND (SELECT 1 FROM (SELECT SLEEP(10))a)--

The attacker can now enumerate all tables, dump the users table (containing credentials), documents table (containing file paths and metadata), and settings table (containing application configuration and potentially database credentials in plaintext).

4) Post-Exploitation Impact:

• Database Exfiltration: All data in the connected database is readable. This includes doc content metadata, workflow approvals, and potentially full document binary pointers. If the application stores documents as BLOBs in the database, the attacker can extract entire document contents.
• Credential Harvesting: If user passwords are stored as unsalted MD5 or SHA1 hashes (common in legacy DMS systems), the attacker can crack them offline or use them directly for lateral movement.
• Persistence: The attacker could inject a web shell via SQL INTO OUTFILE (if file permissions allow) or manipulate application data to escalate privileges within Docpedia.

Impact Assessment

Business Impact: Docpedia is a document management system used to store, version, and route corporate documentation — contracts, employee HR records, patient data (in healthcare deployments), or audit trails. Successful exploitation grants an unauthenticated attacker read access to the entire database, exposing:

• Confidential business documents, including intellectual property and legal contracts
• Employee Personally Identifiable Information (PII) and potentially financial records
• System credentials and database connection strings

CVSS Subscore Analysis:

• Attack Vector: Network (AV:N) — Exploitable from anywhere
• Attack Complexity: Low (AC:L) — No special conditions required
• Privileges Required: None (PR:N) — Unauthenticated
• User Interaction: None (UI:N) — No victim action needed
• Scope: Changed (S:C) — Database compromised beyond the web app
• Confidentiality: High (C:H) — Full database content disclosure
• Integrity: None (I:N) — No data modification via this vector
• Availability: None (A:N) — No direct DoS

Blast Radius: Any deployment of Docpedia that is reachable on the network is affected. The Asia-Pacific region is most likely impacted, but any internet-exposed instance is vulnerable. In co-hosted environments, the database server may be shared with other applications, expanding the blast radius.

EPSS Context: The EPSS score is 0.00462 (37.7th percentile), indicating a low-to-moderate probability of exploitation in the wild. However, this is likely a reflection of the product's niche nature, not the vulnerability's exploitability. As the patch becomes more widely known, exploitation attempts are expected to increase.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt Against Flowring Docpedia
id: 7c4d5e6f-8a9b-4c0d-9e1f-2a3b4c5d6e7f
status: experimental
description: Detects common SQL injection patterns in HTTP requests targeting Docpedia endpoints
author: Valtersit Threat Intelligence
date: 2026/04/15
logsource:
  category: webserver
  product: iis
detection:
  selection:
    cs-uri-query|contains:
      - "UNION SELECT"
      - "' OR '1'='1"
      - "SLEEP("
      - "WAITFOR DELAY"
      - "sqlmap"
  filter:
    cs-uri-query|contains:
      - "/docpedia/API/"
  condition: selection and filter
  timeframe: 10s
level: high
falsepositives:
  - Legitimate debugging tools hitting Docpedia APIs
fields:
  - clientip
  - cs-method
  - cs-uri-query
  - sc-status

YARA Rule

rule CVE_2026_2093_SQLi_Docpedia
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection payloads targeting Flowring Docpedia"
        date = "2026-04-15"
        reference = "CVE-2026-2093"
        severity = "critical"
    strings:
        $s1 = "UNION SELECT" ascii nocase
        $s2 = "SLEEP(" ascii nocase
        $s3 = "WAITFOR DELAY" ascii nocase
        $s4 = "information_schema" ascii nocase
        $s5 = "' OR 1=1" ascii nocase
        $s6 = "/docpedia/" ascii nocase
    condition:
        uint16(0) == 0x0D0A and
        ($s6 in (0..filesize)) and
        (1 of ($s1, $s2, $s3, $s4, $s5) in (0..filesize))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-2093 Flowring Docpedia SQL Injection Attempt"; flow:established,to_server; content:"/docpedia/"; http_uri; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; distance:0; content:"SLEEP"; http_uri; nocase; sid:20262093; rev:1; classtype:web-application-attack; reference:cve,2026-2093;)

Elastic Detection

network where process != null and
  dns.question.name != "blocked.elastic.co" and
  url.path contains "/docpedia/" and
  (
    url.query contains "UNION SELECT" or
    url.query contains "SLEEP(" or
    url.query contains "WAITFOR" or
    url.query contains "' OR '1'='1"
  )

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=access_combined
| where LIKE(cs_uri_query, "%/docpedia/%")
  AND (
    LIKE(cs_uri_query, "%UNION%SELECT%") OR
    LIKE(cs_uri_query, "%SLEEP(%") OR
    LIKE(cs_uri_query, "%WAITFOR%") OR
    LIKE(cs_uri_query, "%' OR '1'='1%")
  )
| stats count by clientip, cs_uri_query, sc_status
| sort - count

Wazuh OSSEC Rule

<rule id="202693" level="10">
  <decoded_as>web</decoded_as>
  <description>SQL Injection attempt against Flowring Docpedia (CVE-2026-2093)</description>
  <group>sql_injection,web_application_attack,</group>
  <if_sid>31100</if_sid>  <!-- Apache/IIS generic web log -->
  <regex>(\/docpedia\/)|(UNION SELECT)|(SLEEP\()|(WAITFOR)</regex>
  <options>no_full_log</options>
  <mitre>
    <id>T1190</id>
    <tactic>TA0001</tactic>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Status Confidence: 2/4 — CLAIMED. The vendor (Flowring, via CNA twcert) has announced a hotfix, but this has not been independently confirmed by third-party researchers or vendors. Treat the patch as authoritative but verify integrity against the vendor's official distribution channel.

1) Immediate Mitigations (within 24 hours):

• If the Docpedia instance is exposed to the internet, restrict access immediately. Place the application behind a VPN or apply IP allowlisting at the firewall/WAF layer.
• Deploy a Web Application Firewall (WAF) rule set that blocks common SQL injection payloads, specifically signatures for UNION SELECT, SLEEP(), WAITFOR, and comment-based injection (--, /*).
• Monitor access logs for anomalous requests to Docpedia endpoints containing SQL keywords. Use the detection rules above for automated alerting.

2) Patch / Upgrade Steps:

• Apply the vendor hotfix DP4 HotFix_057 immediately. Contact Flowring or your regional distributor to obtain the patch. Confirm the patch's SHA-256 hash with the vendor to prevent supply-chain tampering.
• After applying the hotfix, perform regression testing on document search, retrieval, and workflow functions to ensure normal operation.
• If the hotfix is unavailable or cannot be verified, contact Flowring support for emergency guidance.

3) Long-Term Hardening:

• Isolate the Docpedia backend database on a separate network segment with strict egress firewall rules.
• Enforce password policy and enable Multi-Factor Authentication (MFA) for all Docpedia user accounts, particularly administrative accounts.
• Implement database-level least-privilege: the Docpedia application account should only have SELECT/INSERT/UPDATE on the required tables — never FILE privileges (prevents INTO OUTFILE web shell writing).
• Ensure the application is not running with elevated OS privileges (e.g., NT AUTHORITY\SYSTEM or root). Use a dedicated low-privileged service account.
• Subscribe to Flowring's security advisory mailing list to receive future CVE notifications promptly.
• Conduct an incident response review to determine whether the application has been accessed by untrusted IPs prior to patching, given the vulnerability's unauth nated nature.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-2093
2. TWCERT/CC Advisory (Original CNA): https://www.twcert.org.tw/tw/cp-132-XXXX-CVE-2026-2093.html (Note: Verify via TWCERT/CC portal)
3. Flowring Official Site (Vendor Page): https://www.flowring.com (Refer to support portal for DP4 HotFix_057)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-2093 is NOT listed; no evidence of exploitation in the wild as of this report.

Threat Actor/Exploitation Evidence: As of this writing, there is no confirmed weaponized exploit, no Nuclei template, no metasploit module, and no evidence of active exploitation campaigns referencing CVE-2026-2093. However, given the similarity of this flaw to other DMS SQL injection vulnerabilities (e.g., CVE-2023-XXXXX in competing products), the likelihood of integration into automated scanning tools is high once the patched vs. unpatched differential becomes measurable. Organizations should treat the vulnerability as actively exploitable but unproven in the wild — the high CVSS score and unauthenticated nature demand urgent attention regardless of EPSS probability.