Executive brief
DefaultFuction Customer Relationship Management System is software used to manage customer orders and relationships. A SQL injection vulnerability in the order deletion function allows authenticated attackers to manipulate the database directly, potentially exposing customer data, modifying records, or disrupting service availability.
Technical details
A SQL injection vulnerability exists in the /modules/orders/delete.php file of DefaultFuction CRM version 1.0.0. The vulnerable 'id' parameter (passed via GET request) fails to properly sanitize or validate user input before incorporating it into SQL queries. An authenticated attacker can inject malicious SQL code through the id parameter to manipulate database queries, potentially extracting sensitive data, modifying records, or gaining unauthorized database access. The vulnerability requires prior authentication or session access to exploit. Remediation involves implementing prepared statements, input validation, database permission minimization, and regular security audits.
Affected products
- DefaultFuction CRM 1.0.0
Timeline
- 2026-07-19: disclosed
- 2026-09-06: advisory