CVE-2026-86170
MediumCVSS 6.3Summary
A vulnerability has been identified in DefaultFuction CRM 1.0.0, specifically in the file /modules/orders/edit.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk to the organization includes potential remote compromise of the database, data theft or modification, and possible privilege escalation within the system.
Recommendation
It is recommended to apply patches or updates to the CRM system immediately, and to validate and sanitize input for the ID parameter. Also, restrict access to the edit.php file.
Other vulnerabilities in DefaultFuction CRM
See all- CVE-2026-86172Medium
A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
- CVE-2026-86171Medium
A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Original NVD description (English source)
A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.