CVE-2026-86172: SQL Injection in DefaultFuction CRM

DefaultFuction CRM 1.0.0 contains a SQL injection vulnerability in an unspecified function within /modules/customers/delete.php. The vulnerability arises from improper sanitization of the ID parameter, allowing an attacker to inject SQL commands remotely. The CVSS 4.0 score is 5.3 (medium), indicating moderate impact with network attack vector, low complexity, and no privileges or user interaction required. Exploit code is publicly available, increasing the risk of exploitation. No official patch or remediation guidance has been disclosed by the vendor.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The vulnerability requires no user interaction and low attack complexity, but the overall impact is limited to the confidentiality, integrity, and availability of the affected system's data as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected module and validate or sanitize input parameters at the application or network level to mitigate exploitation risk.