Description

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T04:17:15.717Z",
  "pubdate": "2026-09-13T04:17:15.717Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in Feng Office versions up to 3.11.13.11, specifically within the Legacy API component.\nThe vulnerability originates from improper neutralization of input within the 'auth' argument processed by the 'Contacts::instance->findAll' function located in 'application/models/CompanyWebsite.class.php'.\nThis flaw allows remote, unauthenticated attackers to inject arbitrary SQL commands into the backend database queries.\nSuccessful exploitation poses a severe risk to data confidentiality, integrity, and availability, potentially leading to unauthorized data exfiltration, modification, or complete database compromise.\nGiven that the exploit is publicly disclosed and the vendor has not provided a responsive fix, the risk to organizations utilizing affected versions is high.\nAttackers can leverage this vulnerability over the network without requiring prior authentication, making it a highly accessible vector for malicious actors.",
  "technicalDetails": "The vulnerability resides in the 'Contacts::instance->findAll' method defined within 'application/models/CompanyWebsite.class.php'. This function is part of the Legacy API component of Feng Office.\nThe root cause is the failure to properly sanitize or parameterize the 'auth' input parameter before incorporating it into a database query string. The application treats user-supplied data in the 'auth' argument as trusted content, allowing it to alter the structure of the underlying SQL statement executed against the database management system.\nExploitation is achieved by supplying a specially crafted 'auth' parameter via a network request to the vulnerable endpoint. By injecting malicious SQL syntax (e.g., using UNION-based injection or boolean-based blind techniques), an attacker can manipulate the query logic to bypass authentication, access sensitive information in unauthorized tables, or modify database contents.\nThe attack flow proceeds as follows: First, the attacker identifies a request processed by the Legacy API that invokes 'Contacts::instance->findAll'. Second, the attacker crafts a malicious payload targeting the 'auth' argument. Third, the application receives this input and concatenates it directly into a SQL query string. Fourth, the database engine executes the modified query, enabling the attacker to extract data or perform unauthorized operations based on the injected commands.\nBecause this vulnerability is located within a remote-facing component and does not require pre-existing authentication, it significantly lowers the barrier for exploitation. The lack of input validation or the absence of prepared statements (parameterized queries) is the fundamental architectural deficiency allowing this SQL injection.\nThe post-exploitation impact includes full database read/write access. Depending on the database configuration and permissions, an attacker might be able to escalate privileges, dump user credentials, access private customer contact lists, or potentially perform administrative actions within the Feng Office application. Given the public availability of exploit information, systems remaining on affected versions (up to 3.11.13.11) are at immediate risk."
}