Remote SQL Injection in Feng Office Legacy API

A critical SQL injection vulnerability exists in Feng Office versions up to 3.11.13.11, specifically affecting the 'findAll' function within 'application/models/CompanyWebsite.class.php'. This component, part of the Legacy API, fails to properly neutralize the 'auth' argument before incorporating it into database queries. Remote, unauthenticated attackers can exploit this flaw to inject arbitrary SQL commands, potentially leading to unauthorized data exfiltration, modification, or full compromise of the backend database. While public proof-of-concept exploits exist, the vendor has not responded to disclosure reports, leaving current installations at high risk. Detection engineers should focus on monitoring HTTP traffic for patterns associated with SQL injection attempts targeting the Legacy API endpoint.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass authentication controls and execute arbitrary SQL queries against the application database. This can lead to the exposure of sensitive organizational data, including contact information and internal records, as well as the potential for administrative account takeovers or database-level system modifications.

Recommendation

1. Review web server logs for suspicious 'auth' parameter values containing SQL syntax characters (e.g., UNION, SELECT, --, ;) targeting the Legacy API path.
2. Implement WAF rules to sanitize or block input to the 'auth' parameter in the Legacy API module.
3. If patching is unavailable due to lack of vendor response, restrict network access to the Legacy API component using edge firewall controls.