CVE-2026-90496 describes a SQL injection vulnerability in Fengoffice Feng Office versions up to 3.11.13.11. The flaw is located in the update_system_module_order and update_dimension_order functions within application/controllers/MoreController.class.php, specifically in the Reorder Handlers component. By manipulating the modules/dims argument, an attacker with high privileges can inject SQL commands remotely. The vendor was notified but did not provide any response or patch. Public exploit code exists, but no active exploitation has been confirmed.

Successful exploitation could lead to unauthorized SQL commands being executed, potentially impacting confidentiality, integrity, and availability of the affected system. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. No known active exploitation in the wild has been reported.

No official patch or remediation has been provided by the vendor as of the publication date. Users should monitor vendor channels for updates. Until a fix is available, restrict access to the affected functions to trusted users only and consider implementing web application firewall rules to detect and block SQL injection attempts targeting the modules/dims parameter.