Executive brief
Feng Office is a web-based business and project management application. A vulnerability in its reorder functionality allows an attacker to inject malicious SQL commands by manipulating the modules/dims parameter, potentially enabling unauthorized access to sensitive data in the database without requiring authentication.
Technical details
The vulnerability is a SQL injection flaw in the update_system_module_order and update_dimension_order functions within application/controllers/MoreController.class.php. The vulnerability exists in the reorder handlers component where user-supplied input in the modules/dims parameter is not properly sanitized before being used in SQL queries. The attack is remotely initiable and requires no authentication. An attacker can craft a malicious request to extract, modify, or delete database records. The vendor was notified early but provided no response regarding a patch.
Affected products
- Feng Office Feng Office up to 3.11.13.11
Timeline
- 2026-09-13: disclosed