Description

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-13T06:16:25.750Z",
  "pubdate": "2026-09-13T06:16:25.750Z",
  "executiveSummary": "A critical SQL injection (SQLi) vulnerability has been identified in Feng Office up to version 3.11.13.11, specifically within the Reorder Handlers component.\nThe vulnerability resides in the update_system_module_order and update_dimension_order functions, allowing an unauthenticated or remote attacker to inject malicious SQL commands via the 'modules/dims' argument.\nSuccessful exploitation of this flaw can lead to unauthorized access, manipulation, or exfiltration of the application's backend database, posing a severe risk to data integrity and confidentiality.\nThe attack is remotely exploitable, and the existence of public exploit code increases the likelihood of active exploitation. Given that the vendor remains unresponsive, users are at increased risk as no official patches are currently available.\nOrganizations using affected versions should consider immediate deployment of mitigating controls, such as WAF rules or input filtering, to neutralize potential exploit attempts.",
  "technicalDetails": "The vulnerability is situated within the file application/controllers/MoreController.class.php, specifically affecting the functions 'update_system_module_order' and 'update_dimension_order'.\nThe root cause is the improper neutralization of user-supplied data within the 'modules/dims' argument before processing it in database queries. This indicates a failure to use parameterized queries or appropriate input sanitization mechanisms when handling user input directed toward the underlying database abstraction layer.\nExploitation is achieved by injecting arbitrary SQL fragments into the 'modules/dims' input field. Because the application processes this input directly within database operations, the malicious payload is interpreted by the database engine as part of the intended SQL command structure.\nThe attack flow begins with the attacker sending a specially crafted request (typically a POST request) containing a malicious SQL injection string to the MoreController endpoint. The application fails to validate the structure or content of the 'modules/dims' argument, passing the raw input to the database handler. Consequently, the attacker can break out of the intended query context, allowing for unauthorized operations such as UNION-based data extraction, database schema enumeration, or, in certain configurations, data modification.\nSince the vulnerability exists within a core controller, it is accessible via network communication. The lack of input validation at this entry point permits remote execution, potentially bypassing intended access controls depending on the backend query context. As an exploit has been made public, attackers can readily leverage this flaw to gain unauthorized insights into the application data or achieve deeper persistence if the database privileges are overly permissive.\nPost-exploitation impact includes full database compromise, which may lead to the disclosure of sensitive user credentials, configuration data, and business-critical information. Given the nature of the application, this could lead to a complete takeover of the Feng Office instance."
}