Description

A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-06T06:16:41.403Z",
  "pubdate": "2026-09-06T06:16:41.403Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in DefaultFuction CRM 1.0.0, specifically within the /modules/orders/edit.php script.\nThis vulnerability allows an unauthenticated remote attacker to manipulate database queries by injecting malicious SQL commands via the 'ID' argument.\nSuccessful exploitation permits unauthorized access to the underlying database, potentially leading to the exposure of sensitive order data, modification of existing records, or complete compromise of the application's data integrity.\nThe vulnerability is currently public, significantly increasing the risk of active exploitation by malicious actors.\nThe flaw stems from insufficient input sanitization of user-supplied data before it is incorporated into a database query.\nGiven that the exploit is publicly available, organizations deploying this version of DefaultFuction CRM are at an elevated risk of data breach and should prioritize mitigating the issue immediately.",
  "technicalDetails": "The vulnerability is a classic SQL injection (SQLi) flaw located within the /modules/orders/edit.php file of DefaultFuction CRM 1.0.0. The root cause of this issue is improper neutralization of user-controlled input passed to the 'ID' argument before it is utilized in a database query.\nThe vulnerable component is the parameter handler responsible for processing the 'ID' argument within /modules/orders/edit.php. The application logic fails to employ parameterized queries or prepared statements, instead likely concatenating the raw, unsanitized input directly into an SQL command string.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP request (GET or POST) to the /modules/orders/edit.php endpoint, substituting the expected legitimate 'ID' value with a malicious SQL payload. Because the application lacks adequate input filtering, the database engine interprets the injected SQL syntax as part of the intended query rather than as literal data.\nExploitation allows for the alteration of the query's logic, enabling an attacker to bypass authentication, retrieve unauthorized records, or extract metadata about the database structure.\nThe attack can be executed remotely over the network, requiring no prior authentication or administrative privileges. The publicly available exploit code suggests that the injection point is easily accessible and requires minimal effort to leverage.\nPost-exploitation impact includes, but is not limited to, the unauthorized disclosure of sensitive CRM information, potentially impacting customers' order history, personal data, and internal business documentation. In some database configurations, this flaw could potentially be escalated to gain broader unauthorized access to the database server or execute administrative commands, depending on the permissions of the database user account utilized by the application."
}