CVE-2024-48218

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list...

PT-2024-33032 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: Funadmin version 5.0.2 Description: The issue is a SQL injection vulnerability located in the /curd/table/edit API endpoint. This allows for potential exploitation by injecting malicious SQL code. Recommendations: For Funadmin version 5.0.2,...

FunAdmin 安全漏洞

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which stems from a logic flaw in the Curd one-click command delete function that could lead to a denial of...

PT-2024-33041 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: funadmin version 5.0.2 Description: The issue is related to SQL Injection via the parentField parameter in the index method of backendcontrollerauthAuth.php. There is no information provided about the estimated number of potentially affected...

FunAdmin 安全漏洞

FunAdmin is FunAdmin open source development based on ThinkPHP6 + Layui development of a lightweight high-color backend development system. A security vulnerability exists in FunAdmin version 5.0.2, which originates from an SQL injection vulnerability in the parentField parameter of the index...

CVE-2024-48223

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist...

FunAdmin 安全漏洞

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which originates from an arbitrary file read vulnerability in /curd/index/editfile...

CVE-2024-48229

Funadmin 5.0.2 is affected by a SQL injection in the Curd one-click command mode plugin. The vulnerability arises from improper input validation, allowing user-supplied data to be directly included in SQL queries without sanitization. This affects the Curd one-click command mode plugin and can im...

CVE-2024-48228

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...

CVE-2024-48222

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...

FunAdmin 安全漏洞

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which originates from an SQL injection vulnerability in the Curd one-click command mode plugin...

CVE-2024-48223

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist...

Funadmin 安全漏洞

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in Funadmin version 5.0.2, which originates from an arbitrary file deletion vulnerability in /curd/index/delfile...

CVE-2024-48223

Funadmin v5.0.2 is affected by a SQL injection in the /curd/table/fieldlist API endpoint. The root cause is improper handling/validation of input in that endpoint, enabling attacker-controlled SQL commands. Documented impact scope includes potential data disclosure/modification with high severity...

CVE-2024-48226

Funadmin 5.0.2 has a SQL injection vulnerability in curd/table/savefield. The issue arises from improper input handling, enabling manipulation of database queries and potential unauthorized data access/alteration. This is confirmed across multiple sources (GHSA, OSV, NVD/NVD-derived entries, Vera...

CVE-2024-48218

Funadmin v5.0.2 is affected by a SQL injection in the /curd/table/list endpoint. The vulnerability is caused by improper input sanitization in that endpoint (supported by Veracode description and Snyk report citing the list method in curd/controller/Table.php). Exploitation could allow attackers ...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the selectFields parameter in the index function in Auth.php. Remediation There is no fixed version for funadmin/funadmin. References - GitHub Issue - Vulnerable Code...

SQL injection in funadmin

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \app\backend\controller\auth\Auth.php...

GHSA-7PP4-388X-2XQJ SQL injection in funadmin

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \app\backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...