CVE-2026-90495 Overview
CVE-2026-90495 is a SQL injection vulnerability affecting Fengoffice Feng Office versions up to 3.11.13.11. The flaw resides in the Contacts::instance->findAll function within application/models/CompanyWebsite.class.php, part of the Legacy API component. Attackers can manipulate the auth argument to inject arbitrary SQL statements against the backend database. The vulnerability is remotely exploitable without authentication or user interaction. Public disclosure has occurred and exploit details are available. The vendor was contacted prior to disclosure but did not respond, leaving affected deployments without an official patch.
Critical Impact
Remote, unauthenticated attackers can inject SQL through the Legacy API to read, modify, or exfiltrate data stored in Feng Office collaboration workspaces.
Affected Products
- Fengoffice Feng Office versions up to and including 3.11.13.11
- Component: Legacy API (application/models/CompanyWebsite.class.php)
- Function: Contacts::instance->findAll
Discovery Timeline
- 2026-09-13 - CVE-2026-90495 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-90495
Vulnerability Analysis
The vulnerability is a SQL injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It affects the Contacts::instance->findAll code path inside CompanyWebsite.class.php, a legacy model file exposed through the Feng Office Legacy API. The auth parameter passed to this endpoint is concatenated into a SQL query without adequate sanitization or parameterization. As a result, attacker-controlled input reaches the database engine as executable SQL syntax. Because the endpoint is reachable over the network without authentication, exploitation requires only crafted HTTP requests to a vulnerable Feng Office instance.
Root Cause
The root cause is missing input validation and lack of prepared statements when handling the auth argument in the Legacy API. Feng Office builds SQL queries through string interpolation of request parameters, allowing metacharacters such as single quotes, comments, and boolean operators to alter query structure. The Legacy API surface has not been refactored to use parameterized queries, and the vendor has not issued a fix.
Attack Vector
Exploitation is performed remotely across the network. An attacker sends an HTTP request to the Legacy API endpoint associated with CompanyWebsite, supplying a malicious auth value. The injected payload can extract database contents through UNION-based queries, perform blind boolean or time-based inference, or modify records. Because no credentials are required, mass scanning and automated exploitation of internet-exposed Feng Office deployments is feasible.
No verified proof-of-concept code is included here. Public exploit details are referenced in the VulDB CVE-2026-90495 entry and the VulDB Vulnerability #403083 advisory.
Detection Methods for CVE-2026-90495
Indicators of Compromise
- HTTP requests to Feng Office Legacy API endpoints containing SQL metacharacters in the auth parameter, such as single quotes, UNION SELECT, --, /*, SLEEP(, or BENCHMARK(.
- Web server or application logs showing repeated 500-series errors originating from CompanyWebsite.class.php or Contacts::instance->findAll.
- Unexpected database query volume or long-running queries correlated with Legacy API traffic.
Detection Strategies
- Deploy web application firewall (WAF) signatures that flag SQL injection patterns targeting the auth parameter on Feng Office Legacy API routes.
- Enable database query logging and alert on anomalous SELECT statements referencing internal schema tables from the Feng Office application user.
- Correlate authentication-free API requests with database error responses to surface probing activity.
Monitoring Recommendations
- Ingest Feng Office web server, PHP error, and MySQL/MariaDB query logs into a centralized analytics platform for baselining and anomaly detection.
- Alert on outbound data transfers from the Feng Office host that exceed baseline volumes, indicating potential data exfiltration.
- Monitor for new administrative accounts, modified contact records, or unexpected changes to fo_contacts and related tables.
How to Mitigate CVE-2026-90495
Immediate Actions Required
- Restrict network access to Feng Office instances by placing them behind a VPN or IP allowlist until a patch is available.
- Disable or block the Legacy API routes that expose CompanyWebsite and Contacts::instance->findAll if not required for operations.
- Audit database and application logs for prior exploitation attempts and rotate any credentials stored within the Feng Office database.
Patch Information
No official vendor patch is available. According to the disclosure, the vendor was contacted prior to publication but did not respond. Administrators should track the VulDB Vulnerability #403083 entry and the Fengoffice project repository for future fixes, and consider migrating to a maintained collaboration platform if patches are not released.
Workarounds
- Deploy a WAF rule to reject requests where the auth parameter contains SQL syntax characters or keywords.
- Apply a source-code hotfix to application/models/CompanyWebsite.class.php that validates the auth argument against an expected format and uses parameterized queries via the underlying database abstraction layer.
- Run the Feng Office database account with least-privilege permissions to limit the impact of successful injection, denying FILE, CREATE USER, and cross-database access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
