Feng Office Workspaces sql injection

Vulnerability

Feng Office version 3.11.1.2 contains a blind SQL injection vulnerability in the Workspaces component. The dim parameter, passed via HTTP GET request, is not properly sanitized before being used in SQL queries. This allows an attacker to inject arbitrary SQL statements. The issue affects the exact version 3.11.1.2.

Exploitation

An attacker must be logged into the application and then navigate to the Workspaces page. By modifying the dim parameter in the URL, the attacker can inject SQL commands. The exploit can be automated using SQLMap, as demonstrated in the public disclosure [1]. The attack requires no special privileges beyond a valid user session and can be launched remotely.

Impact

Successful exploitation allows an attacker to extract sensitive information from the underlying MySQL database, including user credentials and other stored data. The blind SQL injection nature means the attacker can enumerate data row by row. The attacker does not gain direct code execution but can compromise the confidentiality of the database contents [1].

Mitigation

As of the publication date, no official patch has been released by Feng Office. Users should apply input validation and parameterized queries to the dim parameter as a workaround. The vendor has not yet addressed this vulnerability in a public advisory. The exploit is publicly known and may be used in attacks [1].