Feng Office EUVD-2026-76949

Exploitation requires an authenticated session with high administrative privileges (PR:H per the CVSS 4.0 vector) - specifically, the ability to invoke the update_system_module_order or update_dimension_order functions in the Feng Office administrative interface. The application must be accessible over the network (AV:N). No special non-default configuration is required beyond the attacker holding a high-privilege account; the reorder handler is part of standard Feng Office functionality. The critical limiting factor is the high-privilege prerequisite: unauthenticated users and low-privilege users cannot directly exploit this flaw without first compromising an administrator account through a separate attack vector such as credential theft or phishing.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) reflects a network-exploitable SQL injection that requires high-privilege access and yields only limited impact - the injectable context appears to involve ordering/index columns rather than full data-retrieval queries, constraining the blast radius. The E:P supplemental metric confirms a public proof-of-concept is available, which modestly elevates urgency despite the 5.1 base score. No CISA KEV listing is present and no EPSS data was provided, so exploitation probability in the wild is unconfirmed. The absence of a vendor patch - the vendor did not respond to coordinated disclosure - means there is no remediation timeline, and even a mid-sized municipal IT team in kalisz running Feng Office internally should treat this as a medium-priority issue given that compensating controls at the WAF or network layer are the only available mitigations. The primary risk limiter is the PR:H requirement: external attackers must first obtain high-privilege credentials before exploiting this flaw, making it less dangerous than unauthenticated SQL injection vulnerabilities of comparable CVSS.

An attacker who has obtained high-privilege credentials to a Feng Office deployment accesses the administrative module reorder interface and submits a crafted HTTP request containing SQL injection payloads in the modules or dims parameter. Because the application passes this input directly into a SQL query without sanitization, the attacker can enumerate database tables or partially modify records. A public proof-of-concept demonstrating the technique has been published on Google Drive.