| 标题 | Feng Office Feng Office Community Edition 3.11.13.11 SQL Injection |
|---|
| 描述 | Unauthenticated SQL Injection and Authentication Bypass in Feng Office Community Edition x.x.x.x via the API auth token parameter.
Endpoint: GET /index.php?c=api&a=index&auth=<token>
Vulnerable code: application/models/CompanyWebsite.class.php (~line 110)
The legacy API resolves the caller by concatenating $_REQUEST['auth'] directly into SQL before session establishment:
Contacts::instance()->findAll(array(
"conditions" => "`token` = '".$_REQUEST['auth']. "'"
));
An unauthenticated remote attacker can inject SQL via auth. Confirmed impacts:
1) Authentication bypass with auth=' OR '1'='1 (response matches valid-token success)
2) Error-based database exfiltration via extractvalue (lab DEBUG), including administrator contact/API token from og_contacts
CWE-89. CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8)
Vendor coordination (responsible disclosure):
- 2026-06-14: Initial coordinated disclosure emailed to [email protected] and [email protected] by Nir Yehoshua (Cipher Security Labs), covering this finding plus two additional issues; technical write-up and video PoC shared privately via Google Drive.
- 2026-06-18: Juan Manjarres (Feng Office) acknowledged receipt and stated the team would analyze and respond.
- 2026-07-04 and 2026-07-07: Follow-up emails requesting triage status, patch intent, CVE coordination preference, and timeline. No further substantive response received as of submission.
- Coordinated 90-day disclosure window from 2026-06-14 ends 2026-09-12.
- CVE assignment requested externally because Feng Office has not confirmed they will handle CVE allocation.
No prior public CVE identified for this auth-token SQLi class. Video PoC: https://drive.google.com/file/d/1Pc3Xn0funYMa-N-1ihZjSWrpS-zhqbna/view?usp=sharing |
|---|
| 用户 | ciphersecuritylabs (UID 99852) |
|---|
| 提交 | 2026-07-16 11時38分 (2 月前) |
|---|
| 管理 | 2026-09-12 10時16分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 403083 [Fengoffice Feng Office 直到 3.11.13.11 Legacy API CompanyWebsite.class.php instance->findAll auth SQL注入] |
|---|
| 积分 | 17 |
|---|