A security vulnerability has been detected in DefaultFuction CRM 1.0.0. (CVE-2026-86171)

DefaultFuction CRM 1.0.0 contains a SQL injection vulnerability in the /modules/orders/delete.php file due to improper sanitization of the ID parameter. This flaw allows remote attackers with low privileges to manipulate SQL queries, potentially impacting the confidentiality, integrity, and availability of the application. The vulnerability is tracked as CVE-2026-86171 with a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No patch or official remediation information is provided, and the affected versions are not explicitly stated beyond version 1.0.0. Public disclosure of the exploit exists, but no known exploitation in the wild has been confirmed.

The vulnerability allows remote attackers with low privileges to perform SQL injection attacks by manipulating the ID argument in the delete.php module. This can lead to partial loss of confidentiality, integrity, and availability of the affected system. The CVSS score of 6.3 reflects a medium severity impact. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the vulnerable module and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the affected functionality to untrusted users.