Defaultfuction
Monthly
SQL injection in DefaultFuction CRM 1.0.0 allows low-privileged authenticated attackers to manipulate the `ID` parameter in `/modules/customers/delete.php`, enabling unauthorized database read and write operations. A public proof-of-concept exploit is available via a GitHub issue on the vendor's repository, lowering the bar for exploitation. No vendor-released patch has been identified at time of analysis, leaving deployments dependent on compensating controls.
SQL injection in DefaultFuction CRM 1.0.0 allows authenticated remote attackers to manipulate database queries via the ID argument in /modules/orders/delete.php. The CVSS 4.0 vector (PR:L) confirms low-privilege authentication is required, limiting opportunistic mass exploitation. A public proof-of-concept has been disclosed via a GitHub issue against the project repository, meaning the attack path is documented and reproducible. No patch is available at time of analysis.
SQL injection in DefaultFuction CRM 1.0.0 allows remote attackers with low-privilege accounts to manipulate the underlying database via the unsanitized ID parameter in /modules/orders/edit.php (CWE-89). A publicly available exploit has been published on the project's own GitHub issue tracker, lowering the bar for exploitation considerably. No vendor patch has been identified at time of analysis.
Stack-based buffer overflow in DefaultFuction's Customer-Relationship-Management-In-C-Project 2.0 exposes authenticated remote attackers to arbitrary code execution or application crash by supplying oversized input to the Customer Search Module's unsafe `gets()` call. A public proof-of-concept exploit is available on GitHub, and the project maintainer has acknowledged the issue is only 'being processed,' meaning no patch has been released. The vulnerability is not listed in CISA KEV, but the combination of network accessibility, low access complexity, and public exploit code makes it a credible risk in any environment running this software.
Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. The vulnerability is not yet in CISA KEV, but the combination of network accessibility (AV:N), a low authentication barrier (PR:L), and a live public POC substantially elevates real-world risk beyond what the CVSS 4.0 score of 5.3 conveys.
Remote command injection in DefaultFuction Content-Management-System 1.0 allows unauthenticated attackers to execute arbitrary OS commands via the host parameter in /admin/tools.php. The flaw has a publicly available exploit (POC published on GitHub) and is exploitable over the network with low attack complexity. EPSS data not available, not listed in CISA KEV. CVSS 7.3 reflects network-accessible, unauthenticated command injection with potential for confidentiality, integrity, and availability compromise.
A Server-Side Request Forgery (SSRF) vulnerability exists in DefaultFuction Jeson-Customer-Relationship-Management-System affecting versions up to commit 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. The vulnerability resides in the /api/System.php file where the 'url' parameter can be manipulated to force the server to make arbitrary requests. A publicly disclosed proof-of-concept exploit is available on GitHub, and patches have been released by the vendor.
SQL injection in DefaultFuction CRM 1.0.0 allows low-privileged authenticated attackers to manipulate the `ID` parameter in `/modules/customers/delete.php`, enabling unauthorized database read and write operations. A public proof-of-concept exploit is available via a GitHub issue on the vendor's repository, lowering the bar for exploitation. No vendor-released patch has been identified at time of analysis, leaving deployments dependent on compensating controls.
SQL injection in DefaultFuction CRM 1.0.0 allows authenticated remote attackers to manipulate database queries via the ID argument in /modules/orders/delete.php. The CVSS 4.0 vector (PR:L) confirms low-privilege authentication is required, limiting opportunistic mass exploitation. A public proof-of-concept has been disclosed via a GitHub issue against the project repository, meaning the attack path is documented and reproducible. No patch is available at time of analysis.
SQL injection in DefaultFuction CRM 1.0.0 allows remote attackers with low-privilege accounts to manipulate the underlying database via the unsanitized ID parameter in /modules/orders/edit.php (CWE-89). A publicly available exploit has been published on the project's own GitHub issue tracker, lowering the bar for exploitation considerably. No vendor patch has been identified at time of analysis.
Stack-based buffer overflow in DefaultFuction's Customer-Relationship-Management-In-C-Project 2.0 exposes authenticated remote attackers to arbitrary code execution or application crash by supplying oversized input to the Customer Search Module's unsafe `gets()` call. A public proof-of-concept exploit is available on GitHub, and the project maintainer has acknowledged the issue is only 'being processed,' meaning no patch has been released. The vulnerability is not listed in CISA KEV, but the combination of network accessibility, low access complexity, and public exploit code makes it a credible risk in any environment running this software.
Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. The vulnerability is not yet in CISA KEV, but the combination of network accessibility (AV:N), a low authentication barrier (PR:L), and a live public POC substantially elevates real-world risk beyond what the CVSS 4.0 score of 5.3 conveys.
Remote command injection in DefaultFuction Content-Management-System 1.0 allows unauthenticated attackers to execute arbitrary OS commands via the host parameter in /admin/tools.php. The flaw has a publicly available exploit (POC published on GitHub) and is exploitable over the network with low attack complexity. EPSS data not available, not listed in CISA KEV. CVSS 7.3 reflects network-accessible, unauthenticated command injection with potential for confidentiality, integrity, and availability compromise.
A Server-Side Request Forgery (SSRF) vulnerability exists in DefaultFuction Jeson-Customer-Relationship-Management-System affecting versions up to commit 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. The vulnerability resides in the /api/System.php file where the 'url' parameter can be manipulated to force the server to make arbitrary requests. A publicly disclosed proof-of-concept exploit is available on GitHub, and patches have been released by the vendor.