CVE-2024-48222

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...

CVE-2024-48230

funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48229

funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin...

CVE-2024-48225

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...

FunAdmin 安全漏洞

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which originates from a SQL injection vulnerability in /curd/table/edit...

PT-2024-33038 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: funadmin version 5.0.2 Description: An issue was found in the selectfiles method in backendcontrollersysAttachh.php, where it directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site...

CVE-2024-48224

Funadmin v5.0.2 is vulnerable to an arbitrary file read vulnerability within the /curd/index/editfile endpoint. Additionally, documentation indicates that the application is susceptible to SQL injection due to improper input sanitization in the editfile method located in the controller Index.php ...

CVE-2024-48222: Improper Neutralization of Special Elements used in an SQL Command

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...

CVE-2024-48218

Funadmin v5.0.2 is vulnerable to SQL injection due to improper input sanitization in the /curd/table/list endpoint. Specifically, the vulnerability exists within the list method of the curd controller able.php file. An attacker can manipulate SQL queries to access or modify data within the databa...

CVE-2024-48224

Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile...

CVE-2024-48223

Funadmin v5.0.2 is vulnerable to a SQL injection flaw in the /curd/table/fieldlist endpoint. The root cause is improper authorization within the controller\Table.php file's fieldlist method, which allows an attacker to manipulate SQL queries to access or modify database data . While the specific ...

FunAdmin 安全漏洞

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which originates from an arbitrary file read vulnerability in /curd/index/editfile...

CVE-2024-48226

Funadmin 5.0.2 is vulnerable to SQL Injection due to improper input validation in the curd/table/savefield functionality (specifically within the app\curd\controller\Table.php file). An attacker can exploit this flaw to manipulate database queries, potentially leading to unauthorized access to or...

CVE-2024-48223

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist...

CVE-2024-48222

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the selectFields parameter in the index function in Auth.php. Remediation There is no fixed version for funadmin/funadmin. References - GitHub Issue - Vulnerable Code...

SQL injection in funadmin

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \app\backend\controller\auth\Auth.php...

GHSA-7PP4-388X-2XQJ SQL injection in funadmin

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \app\backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48231

Funadmin version 5.0.2 is vulnerable to SQL Injection due to the improper handling of the selectFields parameter within the index method of the ackend controller auth Auth.php file. An attacker can exploit this flaw to manipulate database queries, potentially leading to unauthorized access or da...