CVE-2026-86170— DefaultFuction CRM edit.php sql injection
Quick assessment
Affected
DefaultFuction CRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 DefaultFuction CRM 1.0.0 中发现了一个安全漏洞。受影响的组件是文件 中的某个未知函数。通过对参数 的操纵可触发 SQL 注入漏洞。该攻击可远程实施。利用该漏洞的代码已经公开，可被用于发起攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86170
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DefaultFuction CRM edit.php sql injection
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| DefaultFuction | CRM | 1.0.0 |
cpe:2.3:a:defaultfuction:crm:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-86170
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86170
请登录查看更多情报信息。
News Coverage for CVE-2026-86170 (1)
Other References for CVE-2026-86170 (3)
-
-
🔗 CVE-2026-86170 in DefaultFuction third-party-advisory
-
🔗 Submit #895742: DefaultFuction CRM V1.0 SQL Injection third-party-advisory
IV. Related Vulnerabilities
Same product: CRM
-
CVE-2026-86171
DefaultFuction CRM delete.php sql injection -
CVE-2026-53761
Frappe CRM: Authentication Bypass via Logged Invitation Keys -
CVE-2026-84111
Chanjet CRM jxf_dump_table.php sql injection -
CVE-2026-58411
ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsan -
CVE-2026-58410
ChurchCRM: Improper object-level authorization allows low-pr
Same vendor: DefaultFuction
-
CVE-2026-86171
DefaultFuction CRM delete.php sql injection -
CVE-2026-19933
DefaultFuction Customer-Relationship-Management-In-C-Project -
CVE-2026-19932
DefaultFuction Notice-System-Managent NoticeController execu -
CVE-2026-5333
DefaultFuction Content-Management-System tools.php command i -
CVE-2026-4623
DefaultFuction Jeson-Customer-Relationship-Management-System
Same weakness: CWE-89
-
CVE-2026-86171
DefaultFuction CRM delete.php sql injection -
CVE-2026-86168
code-projects Content Management System login.php sql inject -
CVE-2026-86164
itsourcecode Sales and Inventory System trans_view.php sql i -
CVE-2026-86163
itsourcecode Sales and Inventory System pro_del.php sql inje -
CVE-2026-86162
SourceCodester Online Voting System ajax.php login sql injec
V. Comments for CVE-2026-86170
No comments yet