| Title | https://www.fengoffice.com/ fengoffice 3.5.1.5 SQL Injection |
|---|
| Description | The id_no_select parameter in FengOffice x.x.x.x is SQL injection.A single quote was submitted in the id_no_select parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present. Additionally, the payload '+(select*from(select(sleep(20)))a)+' was submitted in the id_no_select parameter. The application took 21140 milliseconds to respond to the request, compared with 355 milliseconds for the original request, indicating that the injected SQL command caused a time delay. |
|---|
| Source | ⚠️ https://github.com/YZS17/CVE/blob/main/SQL/SQLi%20in%20fengoffice_3.5.1.5.md |
|---|
| User | XU17 (UID 83703) |
|---|
| Submission | 05/24/2025 17:20 (1 Year ago) |
|---|
| Moderation | 06/01/2025 12:55 (8 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 310766 [Fengoffice Feng Office 3.5.1.5 index.php?c=account&a=set_timezone tz_offset sql injection] |
|---|
| Points | 20 |
|---|