Fengoffice SQL Injection Vulnerability in Account Timezone Setting

A critical SQL injection vulnerability has been identified in Fengoffice version 3.5.1.5. The issue arises in the file 'index.php' when the 'c' parameter is set to 'account' and the 'a' parameter is set to 'set_timezone'. The vulnerability is triggered by manipulating the 'tz_offset' argument, allowing remote attackers to execute arbitrary SQL commands. This exploitation could potentially lead to unauthorized data access or manipulation.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.