CVE-2024-6039: Feng Office SQL Injection Vulnerability

CVE-2024-6039 Overview

CVE-2024-6039 is a SQL injection vulnerability in Feng Office 3.11.1.2, an open-source collaboration and project management platform. The flaw resides in the Workspaces component, where the dim argument is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The issue is tracked as VulDB entry VDB-268752 and maps to [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. The vulnerability is remotely exploitable and requires low-privileged authentication. Exploitation details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances.

Critical Impact
Authenticated remote attackers can inject SQL through the dim parameter in the Workspaces component, potentially exposing or altering application database contents.

Affected Products

Feng Office 3.11.1.2
Fengoffice feng_office Workspaces component
Deployments using the vulnerable dim parameter handler

Discovery Timeline

2024-06-16 - CVE-2024-6039 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6039

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw located in the Workspaces functionality of Feng Office 3.11.1.2. The application accepts a dim request parameter and concatenates its value into a backend SQL query without parameterization or input validation. An authenticated user can supply crafted SQL syntax through this parameter to alter the query logic executed by the database engine.

Successful exploitation can enable data extraction from application tables, including user records and workspace content. Depending on database privileges, attackers may also modify or delete records. The exploit has been publicly disclosed through the Full Disclosure mailing list and a third-party pentest blog, and a proof-of-concept is referenced in Exploit-DB tracking sources.

Root Cause

The root cause is missing input sanitization and lack of prepared statements in the Workspaces query builder that consumes the dim parameter. User-controlled input is trusted and interpolated directly into a SQL statement, violating separation between code and data.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker with a valid low-privileged Feng Office account submits a request to the Workspaces endpoint containing malicious SQL payloads in the dim parameter. No user interaction is required. Because Feng Office is often internet-exposed for remote team collaboration, publicly reachable instances are within scope for opportunistic scanning.

No verified exploit code is reproduced here. Refer to the Msecure Blog Pentest Series and the Full Disclosure Mailing List for the publicly disclosed proof-of-concept details.

Detection Methods for CVE-2024-6039

Indicators of Compromise

Web server access logs showing requests to Workspaces endpoints containing SQL metacharacters such as ', --, UNION, or SLEEP( in the dim parameter.
Database error messages returned in HTTP responses referencing MySQL or MariaDB syntax errors tied to Workspaces queries.
Anomalous query patterns in the Feng Office database showing large UNION SELECT statements or information_schema lookups.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the dim query parameter for SQL injection signatures and known payloads.
Enable database query logging and alert on queries containing suspicious constructs originating from the Feng Office application user.
Correlate authenticated Feng Office session activity with sudden spikes in database read volume or errors.

Monitoring Recommendations

Ingest Feng Office web server and MySQL logs into a centralized SIEM or data lake for anomaly analysis.
Baseline normal Workspaces request patterns and alert on outliers in parameter length or character composition.
Monitor outbound egress from the Feng Office host for data exfiltration following suspicious query activity.

How to Mitigate CVE-2024-6039

Immediate Actions Required

Restrict network access to Feng Office 3.11.1.2 instances behind VPN or IP allowlists until a patched build is deployed.
Audit application accounts and disable inactive or shared low-privileged users that could be leveraged for authenticated exploitation.
Review recent Workspaces requests and database logs for evidence of injection attempts against the dim parameter.

Patch Information

At the time of publication, no vendor advisory or fixed release from Fengoffice is referenced in the CVE record. Administrators should track the VulDB entry and the Fengoffice project channels for an updated version addressing the dim parameter handling. Until a patch is released, apply the workarounds below.

Workarounds

Deploy WAF signatures that reject or sanitize SQL metacharacters in the dim parameter on Workspaces routes.
Apply the database principle of least privilege so the Feng Office database account cannot read sensitive tables or use FILE privileges.
Consider taking internet-exposed Feng Office 3.11.1.2 instances offline or migrating to an isolated network segment until remediation is available.

bash

# Example NGINX rule to block obvious SQLi patterns in the dim parameter
if ($arg_dim ~* "(union|select|sleep\(|--|';)") {
    return 403;
}