CVE-2025-5433 Overview
CVE-2025-5433 is a SQL injection vulnerability in Feng Office 3.5.1.5, an open-source collaboration and project management platform developed by Fengoffice. The flaw resides in the set_timezone action handler accessed through /index.php?c=account&a=set_timezone. Attackers manipulate the tz_offset parameter to inject arbitrary SQL statements into the backend database. Exploitation requires only low-privilege authenticated access and can be launched remotely over the network. The vendor was contacted before public disclosure but did not respond, leaving the vulnerability unpatched. Proof-of-concept exploitation details have been published on GitHub, increasing exposure risk for organizations running the affected version.
Critical Impact
Authenticated remote attackers can inject SQL into the tz_offset parameter, exposing stored data across confidentiality, integrity, and availability dimensions.
Affected Products
- Fengoffice Feng Office 3.5.1.5
- Deployments exposing the /index.php?c=account&a=set_timezone endpoint
- Instances accepting user-supplied tz_offset values without sanitization
Discovery Timeline
- 2025-06-02 - CVE-2025-5433 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5433
Vulnerability Analysis
The vulnerability is a SQL injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It affects the account timezone-setting functionality within Feng Office 3.5.1.5. The application accepts the tz_offset request parameter and incorporates its value into a SQL statement without proper parameterization or input validation.
The attack requires network access and authenticated low-privilege credentials. No user interaction is needed once an attacker holds a valid session. Because the injection targets the timezone update flow, exploitation blends into legitimate account activity and may evade cursory log review.
The vendor did not respond to disclosure attempts, so no official fix exists at the time of publication. Public proof-of-concept material is available in the GitHub PoC for SQLi repository, which lowers the barrier for opportunistic exploitation.
Root Cause
The root cause is missing input sanitization and lack of prepared statements in the set_timezone handler. User-controlled data from the tz_offset parameter is concatenated into a database query. This allows an attacker to break out of the intended query context and append arbitrary SQL clauses.
Attack Vector
An authenticated attacker sends a crafted HTTP request to /index.php?c=account&a=set_timezone with a malicious tz_offset payload. The injected SQL executes with the privileges of the Feng Office database user. Depending on database permissions, attackers can extract sensitive records, modify content, or disrupt database operations. Refer to the VulDB entry #310766 for additional technical context.
No verified exploit code is reproduced here. See the linked references for technical details.
Detection Methods for CVE-2025-5433
Indicators of Compromise
- HTTP requests to /index.php?c=account&a=set_timezone containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences within the tz_offset parameter
- Unusually long or URL-encoded tz_offset values that deviate from expected numeric timezone offsets
- Web server or database error messages tied to malformed queries originating from the timezone update flow
- Anomalous outbound data volume from the Feng Office database host following requests to the affected endpoint
Detection Strategies
- Deploy web application firewall signatures that inspect the tz_offset parameter for non-numeric content and known SQL injection patterns
- Correlate authenticated session activity with successive requests to the set_timezone action to identify automated probing
- Enable database query logging and alert on syntax errors or unexpected UNION and INFORMATION_SCHEMA references
Monitoring Recommendations
- Baseline normal traffic to the account controller and alert on deviations in request rate or parameter entropy
- Monitor the Feng Office application logs for repeated failed timezone updates from the same user account
- Retain HTTP access logs with full query strings to support post-incident reconstruction of injection attempts
How to Mitigate CVE-2025-5433
Immediate Actions Required
- Restrict network access to Feng Office instances by placing them behind a VPN or IP allow list until a vendor patch is released
- Enforce strong authentication and disable or audit inactive accounts to reduce the authenticated attack surface
- Deploy WAF rules that reject requests to /index.php?c=account&a=set_timezone when tz_offset contains non-numeric characters
- Review database logs and web access logs for prior exploitation attempts referencing the affected endpoint
Patch Information
At publication time, Fengoffice has not released a patch for CVE-2025-5433. The vendor did not respond to disclosure outreach. Organizations should track the VulDB CTI entry #310766 for status updates and evaluate migration to alternative collaboration platforms if remediation is not forthcoming.
Workarounds
- Apply a reverse-proxy rule that validates tz_offset against a strict numeric regular expression before requests reach the application
- Configure the Feng Office database user with least-privilege permissions to limit the impact of successful injection
- Isolate the Feng Office database on a dedicated host with no outbound internet access to hinder data exfiltration
- Consider disabling the timezone update feature via source-level modification if in-house engineering resources are available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
