Feng Office CVE-2026-90495

The Legacy API component of Feng Office must be accessible - the vulnerability resides specifically in the CompanyWebsite.class.php Legacy API path, not the primary application interface. No authentication is required (PR:N per CVSS 4.0). No special configuration beyond a network-reachable installation is needed; if the Legacy API is enabled and reachable, exploitation is feasible. Exploitation is limited to database-layer impact (partial read/write/availability per VC:L/VI:L/VA:L); OS-level command execution has not been demonstrated. Deployments that have explicitly disabled or blocked the Legacy API are not exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation with no attack complexity, which is the worst-case access profile. However, the impact metrics are all limited (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N), suggesting the SQL injection provides constrained read and write capability rather than full database dump or OS-level RCE. The CVSS 4.0 score of 6.9 incorporates E:P (exploit proof-of-concept), which correctly reflects the public POC. There is no CISA KEV listing and no EPSS data provided, so broader exploitation probability is unconfirmed. The vendor's non-response to disclosure increases risk for unpatched deployments since no official fix version is known. Real-world risk is meaningful for any internet-exposed Feng Office installation using the Legacy API, but is bounded by Feng Office's niche deployment footprint.

An unauthenticated remote attacker sends a crafted HTTP request to the Feng Office Legacy API endpoint, injecting SQL syntax into the auth parameter processed by Contacts::instance->findAll in CompanyWebsite.class.php. The injected payload manipulates the resulting SQL query to extract database contents (e.g., user credentials or application data) or to modify records. A public POC is available on Google Drive, lowering the skill bar required to execute this attack.