CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

PT-2024-33042 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: Funadmin version 5.0.2 Description: The issue is related to SQL Injection via the selectFields parameter in the index method of the Auth.php file. This allows for potential exploitation. Recommendations: For Funadmin version 5.0.2, consider...

CVE-2024-48231

Funadmin version 5.0.2 is vulnerable to SQL Injection due to the improper handling of the selectFields parameter within the index method of the ackend controller auth Auth.php file. An attacker can exploit this flaw to manipulate database queries, potentially leading to unauthorized access or da...

CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48231: Improper Neutralization of Special Elements used in an SQL Command

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

Unrestricted File Upload

funadmin/funadmin is vulnerable to Unrestricted File Uploads. The vulnerability exists in localinstall function at Addon.php due to not restricting plugin files that can be uploaded which allows an attacker to perform unauthorized actions...

GHSA-5M3M-Q8CQ-77G4 fuadmin vulnerable to insecure file upload

funadmin v3.3.2 and v3.3.3 are vulnerable to insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

Design/Logic Flaw

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097: Unrestricted Upload of File with Dangerous Type

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

FunAdmin 代码问题漏洞

FunAdmin is FunAdmin open source a lightweight and high quality backend development system based on ThinkPHP6 + Layui development . FunAdmin version 3.3.2 and 3.3.3 version of a security vulnerability , the vulnerability stems from allowing the installation of plug-ins through the upload of...

CVE-2023-36097

CVE-2023-36097 affects FunAdmin v3.3.2 and v3.3.3. The issue is an insecure file upload in the plugin installation process, caused by insufficient validation/restrictions on uploaded plugin files. This vulnerability allows an attacker to upload malicious files via the local install mechanism, pot...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

Cross-Site Scripting (XSS)

funadmin is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the JS file name which could be maliciously constructed via tagLoad function of the file Cx.php, which allows an attacker to inject and execute malicious JavaScript on the victim's browser...

CVE-2023-2477

A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability is the function tagLoad of the file Cx.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

Cross site scripting

A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability is the function tagLoad of the file Cx.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...