Executive brief
DefaultFuction CRM is a customer relationship management application used to manage business orders and customer data. A SQL injection flaw in the orders editing module allows authenticated attackers to inject malicious SQL queries through the ID parameter, potentially exposing sensitive customer data, modifying records, or disrupting service availability.
Technical details
A SQL injection vulnerability exists in /modules/orders/edit.php where the 'id' GET parameter is not properly sanitized before being used in database queries. The vulnerability requires prior authentication to the CRM system. An authenticated attacker can craft malicious UNION-based SQL injection payloads (as demonstrated in the public POC) to extract arbitrary data from the database, modify records, or potentially execute administrative operations. The root cause is insufficient input validation and lack of prepared statements or parameterized queries. Vendors should immediately implement prepared statement usage and strict input validation on all user-supplied parameters.
Affected products
- DefaultFuction Customer Relationship Management System 1.0.0
Timeline
- 2026-07-19: disclosed: Vulnerability disclosed on GitHub
- 2026-09-06: advisory: CVE-2026-86170 published