CVE-2026-90496: Feng Office SQL Injection Vulnerability

CVE-2026-90496 Overview

CVE-2026-90496 is a SQL injection vulnerability in Fengoffice Feng Office versions up to 3.11.13.11. The flaw resides in the update_system_module_order and update_dimension_order functions of application/controllers/MoreController.class.php, within the Reorder Handlers component. Attackers can manipulate the modules or dims arguments to inject arbitrary SQL statements. The attack is remotely exploitable and requires high privileges. A public exploit exists, and the vendor did not respond to disclosure attempts. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Authenticated remote attackers can inject SQL through the modules or dims parameters, exposing database contents and enabling limited tampering within the Feng Office application.

Affected Products

• Fengoffice Feng Office up to and including version 3.11.13.11
• Component: Reorder Handlers (MoreController.class.php)
• Functions: update_system_module_order and update_dimension_order

Discovery Timeline

• 2026-09-13 - CVE-2026-90496 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90496

Vulnerability Analysis

The flaw exists in Feng Office's reorder handlers, which accept ordered lists of module or dimension identifiers from authenticated users. The update_system_module_order and update_dimension_order functions in MoreController.class.php concatenate user-supplied values from the modules and dims parameters into SQL queries without adequate sanitization. This allows an authenticated attacker to alter query structure and extract or modify data stored by the application.

Exploitation requires valid credentials with sufficient privileges to reach the reorder endpoints. Once authenticated, the attacker submits crafted parameter values through standard HTTP requests. A public proof-of-concept is available, increasing the likelihood of opportunistic exploitation against exposed instances. The vendor has not issued a patch or acknowledged the disclosure.

Root Cause

The root cause is improper neutralization of user input passed to database queries. The vulnerable functions treat the modules and dims arguments as trusted list elements and interpolate them into SQL statements. No parameterized queries or input validation prevent injection of SQL metacharacters, resulting in the [CWE-74] classification for injection.

Attack Vector

The attack vector is network-based and requires an authenticated session with high privileges. An attacker sends a crafted HTTP request to the reorder endpoints of the vulnerable Feng Office controller, embedding SQL syntax in the modules or dims parameter. Successful exploitation yields limited confidentiality, integrity, and availability impact on the underlying database. The current EPSS probability is 0.202%.

No verified code sample is available. Refer to the VulDB CVE-2026-90496 entry and the VulDB Vulnerability #403084 record for additional technical detail.

Detection Methods for CVE-2026-90496

Indicators of Compromise

• HTTP POST requests to Feng Office reorder endpoints containing SQL metacharacters (single quotes, UNION, SELECT, --, ;) in the modules or dims parameters.
• Unexpected database errors or long-running queries originating from MoreController.class.php executions in web server logs.
• Authenticated sessions issuing atypical volumes of reorder requests to update_system_module_order or update_dimension_order.

Detection Strategies

• Deploy web application firewall rules that inspect parameters submitted to the Reorder Handlers routes and block SQL syntax patterns.
• Enable database query logging and alert on suspicious statements originating from the Feng Office application user.
• Correlate authenticated user actions with query anomalies to identify accounts abusing the vulnerable endpoints.

Monitoring Recommendations

• Monitor outbound database traffic from the Feng Office web server for schema enumeration patterns such as queries against information_schema.
• Track failed and successful authentication events for accounts that subsequently invoke reorder endpoints.
• Review web access logs for repeated requests to MoreController.class.php methods, especially with encoded payloads.

How to Mitigate CVE-2026-90496

Immediate Actions Required

• Restrict access to Feng Office instances to trusted networks or place them behind a VPN until a fix is available.
• Revoke or rotate credentials for high-privilege accounts that are not required for daily operations.
• Deploy WAF signatures that block SQL injection payloads targeting the modules and dims parameters.

Patch Information

No vendor patch has been released. The vendor was contacted before public disclosure and did not respond. Track updates through the VulDB CVE-2026-90496 entry and the Fengoffice project channels for future advisories.

Workarounds

• Limit the number of accounts granted administrative privileges within Feng Office, since exploitation requires high privileges.
• Apply strict input filtering at a reverse proxy or WAF for requests targeting update_system_module_order and update_dimension_order.
• Isolate the Feng Office database account with least-privilege permissions to reduce impact if SQL injection succeeds.
• Consider migrating to an actively maintained collaboration platform if the vendor remains unresponsive.

# Example ModSecurity rule blocking SQL metacharacters on the vulnerable endpoints
SecRule REQUEST_URI "@contains MoreController" \
  "chain,phase:2,deny,status:403,id:1029096,\
   msg:'Potential CVE-2026-90496 SQL injection attempt'"
  SecRule ARGS:modules|ARGS:dims "@rx (?i)(union\s+select|--|;|/\*|\bor\b\s+1=1)" "t:none,t:urlDecodeUni"