CVE-2026-86171
MediumCVSS 6.3Summary
A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Risk Assessment
SQL injection could allow an attacker to gain unauthorized access to or manipulate order data, potentially leading to data integrity issues and potential information leakage.
Recommendation
Apply vendor fixes or use parameterized queries. Restrict access to the delete.php file and monitor logs.
Other vulnerabilities in DefaultFuction CRM
See all- CVE-2026-86172Medium
A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
- CVE-2026-86170Medium
A vulnerability has been identified in DefaultFuction CRM 1.0.0, specifically in the file /modules/orders/edit.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.