A high-severity SQL injection vulnerability in Feng Office poses a significant risk to data integrity and confidentiality due to the availability of a public exploit.

This flaw is a classic SQL injection (CWE-89) located in the application/models/CompanyWebsite.class.php file. An unauthenticated attacker can supply malicious input to the auth parameter within the Legacy API to execute arbitrary database queries.

Successful exploitation of this vulnerability allows unauthorized actors to interact directly with the underlying database, potentially leading to the theft of sensitive business information or unauthorized modification of records. With a CVSS score of 7.3, this issue is considered high-risk, especially given the remote, unauthenticated nature of the attack vector which lowers the barrier to entry for malicious actors.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the Legacy API component or disable it entirely if it is not required for business operations.

Proactive Monitoring: Review web application logs for suspicious patterns in the auth parameter, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application/models/CompanyWebsite.class.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up referenced in the vulnerability record.

Given the public availability of an exploit and the vendor's lack of response, this vulnerability presents an immediate risk to the environment. Security teams must prioritize isolating the affected component and implementing compensating controls to prevent unauthorized database access until an official security update is released.