| Título | Feng Office Feng Office Community Edition 3.11.13.11 SQL Injection |
|---|
| Descripción | Administrator SQL Injection in Feng Office Community Edition x.x.x.x module and dimension reorder handlers (same root cause; two sinks).
Auth required: configuration administrator (can_manage_configuration).
Endpoints / parameters:
1) POST ?c=more&a=update_system_module_order — parameter modules (JSON array)
2) POST ?c=more&a=update_dimension_order — parameter dims (JSON array)
Vulnerable code: application/controllers/MoreController.class.php
(update_system_module_order ~458; update_dimension_order ~551)
JSON-decoded IDs are "sanitized" only with str_replace("'", "", ...) then concatenated into SQL, e.g.:
DB::execute("UPDATE ... SET ordering=$order WHERE id='$mod_id'");
This does not stop JSON-breakout payloads such as:
modules=["1\", \" OR 1=1-- "]
Both reorder endpoints return SQL syntax errors confirming injection. Same privileged session can also reach related admin SQL sinks.
CWE-89. Estimated CVSS 3.1 ~8.8 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Vendor coordination (responsible disclosure):
- 2026-06-14: Included in coordinated disclosure to [email protected] and [email protected] (Nir Yehoshua / Cipher Security Labs), with private technical write-up and video PoC.
- 2026-06-18: Juan Manjarres acknowledged receipt and said Feng Office would analyze.
- 2026-07-04 / 2026-07-07: Follow-ups on validation, patch intent, and CVE handling; no further substantive vendor response.
- 90-day coordinated disclosure date: 2026-09-12.
- External CVE request filed because vendor has not confirmed CVE assignment ownership.
Recommend one CVE covering both reorder sinks (identical root cause).
Video PoC: https://drive.google.com/file/d/1Pc3Xn0funYMa-N-1ihZjSWrpS-zhqbna/view?usp=sharing |
|---|
| Fuente | ⚠️ https://drive.google.com/file/d/1Kel7JTTXVcLDPCVpR0LLbIYetANXvkX6/view?usp=sharing |
|---|
| Usuario | ciphersecuritylabs (UID 99852) |
|---|
| Sumisión | 2026-07-16 11:42 (hace 2 meses) |
|---|
| Moderación | 2026-09-12 10:16 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 403084 [Fengoffice Feng Office hasta 3.11.13.11 Reorder Handlers MoreController.class.php update_system_module_order/update_dimension_order modules/dims inyección SQL] |
|---|
| Puntos | 20 |
|---|