CVE-2026-90496: Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection
A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges (PR:H) and can initiate the attack remotely. No user interaction is required.
Which deployments are affected?
Fengoffice Feng Office versions up to 3.11.13.11 are affected in the Reorder Handlers functionality, specifically the update_system_module_order and update_dimension_order functions in MoreController.class.php.
What is the likely impact of successful exploitation?
Successful SQL injection can affect confidentiality, integrity, and availability at a low impact level according to the supplied vector (C:L/I:L/A:L).
Is exploitation theoretical?
No. A public exploit is available, and the exploitability assessment is rated proof-of-concept (E:P).
Is a vendor fix confirmed?
No vendor response or fix is reported in the available information. If patching cannot be confirmed, restrict access to high-privilege accounts and avoid exposing administrative functionality remotely where possible.