CVE-2024-48230: Improper Neutralization of Special Elements used in an SQL Command

funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48227: Undefined Security Weakness

Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service DOS...

CVE-2024-48230

The funadmin 5.0.2 version is vulnerable to SQL Injection due to improper validation of the parentField parameter within the index method of the \backend\controller\auth\Auth.php file. An attacker can exploit this flaw to manipulate SQL queries, potentially allowing them to access or modify data ...

CVE-2024-48222

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...

CVE-2024-48218

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list...

FunAdmin security vulnerabilities

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which originates from an SQL injection vulnerability in the Curd one-click command mode plugin...

CVE-2024-48229

funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin...

CVE-2024-48227

Funadmin version 5.0.2 is susceptible to a Denial of Service (DoS) vulnerability due to a logical flaw in the Curd one-click command deletion function . Specifically, an attacker can exploit the getSystemTable and Delete methods within the common.php file to delete critical commands, thereby disr...

CVE-2024-48224

Funadmin v5.0.2 is vulnerable to an arbitrary file read vulnerability within the /curd/index/editfile endpoint. Additionally, documentation indicates that the application is susceptible to SQL injection due to improper input sanitization in the editfile method located in the controller Index.php ...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the selectFields parameter in the index function in Auth.php. Remediation There is no fixed version for funadmin/funadmin. References - GitHub Issue - Vulnerable Code...

GHSA-7PP4-388X-2XQJ SQL injection in funadmin

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \app\backend\controller\auth\Auth.php...

SQL injection in funadmin

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \app\backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin version 5.0.2 is vulnerable to SQL Injection due to the improper handling of the selectFields parameter within the index method of the ackend controller auth Auth.php file. An attacker can exploit this flaw to manipulate database queries, potentially leading to unauthorized access or da...

CVE-2024-48231: Improper Neutralization of Special Elements used in an SQL Command

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

PT-2024-33042 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: Funadmin version 5.0.2 Description: The issue is related to SQL Injection via the selectFields parameter in the index method of the Auth.php file. This allows for potential exploitation. Recommendations: For Funadmin version 5.0.2, consider...