Executive brief
DefaultFuction CRM is a customer relationship management system used to manage customer data and operations. A SQL injection vulnerability in the customer deletion module allows authenticated attackers to manipulate database queries, potentially exposing sensitive customer data, modifying records, or disrupting service availability.
Technical details
A SQL injection vulnerability exists in the /modules/customers/delete.php file of DefaultFuction CRM 1.0.0, where the 'id' parameter (via GET request) is not properly sanitized before being used in SQL queries. The vulnerability requires authentication to exploit and allows attackers to inject arbitrary SQL code through the id parameter. By crafting malicious SQL payloads, an attacker can extract sensitive data, modify or delete database records, or potentially gain elevated system access. The fix involves implementing prepared statements with parameter binding, strict input validation, and applying principle of least privilege to database user accounts.
Affected products
- DefaultFuction CRM 1.0.0
Timeline
- 2026-07-19: disclosed: Vulnerability reported via GitHub issue
- 2026-09-06: advisory: CVE-2026-86172 assigned and published