CVE-2023-24775: SQL Injection in Funadmin
Summary
CVE-2023-24775: SQL Injection in Funadmin. Affects funadmin/funadmin versions < 3.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Funadmin is a package available on Packagist that provides administrative functionality for web applications. It is vulnerable to a SQL injection attack in version 3.2.0. This vulnerability allows an attacker to inject malicious SQL code through the selectFields parameter in the Member.php file, potentially leading to unauthorized access, data manipulation, or data leakage.
Vulnerability Detail
The SQL injection vulnerability in Funadmin version 3.2.0 arises from improper input validation and sanitization in the selectFields parameter. An attacker can exploit this vulnerability by crafting a malicious input that includes SQL statements, which are executed by the application's database. This can result in the execution of arbitrary SQL queries, bypassing authentication mechanisms, and potentially compromising the confidentiality, integrity, and availability of the application's data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize and validate the selectFields parameter before using it in SQL queries. This can be achieved by using appropriate sanitization functions or libraries specific to the programming language and database being used. For example, in PHP, the mysqli_real_escape_string() function can be used to escape special characters in the input.
Conclusion
The SQL injection vulnerability in Funadmin version 3.2.0 can have severe consequences, including unauthorized access, data manipulation, and data leakage. It is crucial to promptly update to a patched version and implement proper input validation and sanitization techniques to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for funadmin/funadmin →
FAQ
This vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is important to address this vulnerability promptly to mitigate the risk.
No, only Funadmin version 3.2.0 is affected. It is recommended to update to a patched version, such as 3.2.1 or later.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to the vulnerable application.
Yes, the CVSS score for this vulnerability is 9.8 (Critical).
References
Related vulnerabilities
Recent vulnerabilities recorded for funadmin/funadmin.
