A flaw in DefaultFuction CRM 1.0.0’s /modules/customers/delete.php allows an attacker to control the ID argument, leading to SQL injection. Attackers can remotely send crafted requests; it is inferred that they could read, modify, or delete customer records, compromising the confidentiality and integrity of the database.

The vulnerability exists only in the DefaultFuction CRM product, specifically version 1.0.0. The affected component is the delete.php module used for customer deletion, where ID processing is not properly sanitized.

The CVSS score of 5.3 indicates moderate severity. The attack can be performed remotely without additional authentication, and the exploit is publicly disclosed. EPSS is not available, so the likelihood of exploitation remains uncertain, but the exposure of the delete.php endpoint to the internet increases the risk of undetected attacks. The vulnerability is not listed in CISA KEV. An attacker only needs to supply a manipulated ID parameter; no special privileges are required.