| 제목 | Feng Office Feng Office Community Edition 3.11.13.11 SQL Injection |
|---|
| 설명 | Unauthenticated SQL Injection and Authentication Bypass in Feng Office Community Edition x.x.x.x via the API auth token parameter.
Endpoint: GET /index.php?c=api&a=index&auth=<token>
Vulnerable code: application/models/CompanyWebsite.class.php (~line 110)
The legacy API resolves the caller by concatenating $_REQUEST['auth'] directly into SQL before session establishment:
Contacts::instance()->findAll(array(
"conditions" => "`token` = '".$_REQUEST['auth']. "'"
));
An unauthenticated remote attacker can inject SQL via auth. Confirmed impacts:
1) Authentication bypass with auth=' OR '1'='1 (response matches valid-token success)
2) Error-based database exfiltration via extractvalue (lab DEBUG), including administrator contact/API token from og_contacts
CWE-89. CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8)
Vendor coordination (responsible disclosure):
- 2026-06-14: Initial coordinated disclosure emailed to [email protected] and [email protected] by Nir Yehoshua (Cipher Security Labs), covering this finding plus two additional issues; technical write-up and video PoC shared privately via Google Drive.
- 2026-06-18: Juan Manjarres (Feng Office) acknowledged receipt and stated the team would analyze and respond.
- 2026-07-04 and 2026-07-07: Follow-up emails requesting triage status, patch intent, CVE coordination preference, and timeline. No further substantive response received as of submission.
- Coordinated 90-day disclosure window from 2026-06-14 ends 2026-09-12.
- CVE assignment requested externally because Feng Office has not confirmed they will handle CVE allocation.
No prior public CVE identified for this auth-token SQLi class. Video PoC: https://drive.google.com/file/d/1Pc3Xn0funYMa-N-1ihZjSWrpS-zhqbna/view?usp=sharing |
|---|
| 사용자 | ciphersecuritylabs (UID 99852) |
|---|
| 제출 | 2026. 07. 16. AM 11:38 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 12. AM 10:16 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 403083 [Fengoffice Feng Office 까지 3.11.13.11 Legacy API CompanyWebsite.class.php instance->findAll auth SQL 주입] |
|---|
| 포인트들 | 17 |
|---|