CVE-2026-90495

Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability exists in Feng Office versions 3.11.13.11 and earlier within the Contacts::instance->findAll function of CompanyWebsite.class.php in the Legacy API component. An attacker can supply a crafted auth parameter that is not properly validated, causing the application to execute arbitrary SQL statements. The injection can be used to read, modify or delete sensitive data stored in the application’s database.

Affected Systems

All installations of Feng Office running versions 3.11.13.11 or earlier are vulnerable. The flaw resides in the Legacy API component and affects the CompanyWebsite.class.php model linked to contact management within Feng Office.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. While a public exploit exists, the EPSS score of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote, targeting the Legacy API endpoint, and requires sending a crafted payload that manipulates the auth parameter. Even with the current exposure metrics, the potential damage to the confidentiality and integrity of the database warrants urgent attention.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy a patched or newer version of Feng Office that removes the input validation flaw in CompanyWebsite.findAll.
  • Restrict external access to the Legacy API endpoint through firewall rules or network segmentation to limit the attack surface.
  • Implement strict input validation and parameterized queries for the auth argument within the affected function to prevent SQL injection.

Generated by OpenCVE AI on September 15, 2026 at 17:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
First Time appeared Fengoffice
Fengoffice feng Office
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*
Vendors & Products Fengoffice
Fengoffice feng Office
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 6:07 PM
Reserved
Sep 12, 2026, 8:16 AM

View source JSON

Updated
Sep 14, 2026, 6:06 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 4:17 AM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 15, 2026, 5:45 PM

JSON