CVE-2026-86170: DefaultFuction CRM edit.php sql injection
A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The available severity vector indicates that an attacker needs low-level privileges (PR:L). The attack can be performed remotely and does not require user interaction.
Which endpoint and input are implicated?
The affected file is /modules/orders/edit.php, and the SQL injection is triggered by manipulation of the ID argument. The specific function handling the argument is not identified.
Is exploit code available?
Yes. The supplied information states that a public exploit is available and could be used in attacks.