Description
A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-09-06
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness was identified in DefaultFuction CRM 1.0.0 where an unknown function in /modules/orders/edit.php can be manipulated by altering the ID argument. This misuse allows an attacker to inject arbitrary SQL statements, potentially gaining unauthorized access to or modification of sensitive data in the database. The vulnerability is a classic SQL injection flaw and is listed as CWE-89 in the CVE record.

Affected Systems

The affected product is DefaultFuction CRM version 1.0.0. No other vendor or product versions are explicitly mentioned in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is currently unavailable, and the issue is not listed in the CISA KEV catalog. The attack vector is remote, as the flaw can be triggered over the network by sending a crafted request to the edit.php endpoint. Publicly available exploits have been disclosed, which increases concern for organizations still running the vulnerable version.

Generated by OpenCVE AI on September 6, 2026 at 07:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update or patch DefaultFuction CRM to the latest version that addresses the SQL injection flaw once it is released by the vendor.
  • If no patch is available, restrict or disable access to the /modules/orders/edit.php endpoint until remediation occurs, or enforce strict role‑based access controls to limit the attacker’s ability to exploit the vulnerability.
  • Deploy a web application firewall or similar filtering mechanism to detect and block malicious SQL injection payloads targeting the edit.php endpoint.
  • Sanitize and validate all input parameters, ensuring database interactions use prepared statements or parameterized queries to eliminate injection risk.

Generated by OpenCVE AI on September 6, 2026 at 07:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 06:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Title DefaultFuction CRM edit.php sql injection
First Time appeared Defaultfuction
Defaultfuction crm
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:defaultfuction:crm:*:*:*:*:*:*:*:*
Vendors & Products Defaultfuction
Defaultfuction crm
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Defaultfuction Crm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-06T05:45:11.406Z

Reserved: 2026-09-05T10:39:55.377Z

Link: CVE-2026-86170

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T06:16:41.403

Modified: 2026-09-06T06:16:41.403

Link: CVE-2026-86170

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T07:30:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')