CVE-2024-48223: SQL Injection Vulnerability in Funadmin Package v5.0.2
Summary
CVE-2024-48223: SQL injection in funadmin. Affects funadmin/funadmin versions < 5.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Funadmin is a PHP-based content management system designed for managing web applications. It provides a user-friendly interface for administrators to create, edit, and manage content efficiently. The package is widely used due to its simplicity and flexibility, but it has been found to have a critical SQL injection vulnerability in version 5.0.2, which could allow attackers to manipulate database queries.
Vulnerability Detail
The SQL injection vulnerability in Funadmin v5.0.2 is located in the /curd/table/fieldlist endpoint. This flaw allows an attacker to inject arbitrary SQL code into the database query, potentially leading to unauthorized access to sensitive data, data manipulation, or even complete database compromise. The vulnerability arises from insufficient input validation, allowing malicious SQL statements to be executed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the affected endpoint to mitigate the risk of SQL injection. Ensure that user inputs are properly escaped and validated before being used in database queries.
Conclusion
The SQL injection vulnerability in Funadmin v5.0.2 poses a significant risk to applications using this package. It is crucial to update to the latest version to protect against potential attacks. Implementing additional security measures, such as input validation, can help mitigate risks until an update can be performed.
See every vulnerability recorded for funadmin/funadmin →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by allowing an attacker to interfere with the queries that an application makes to its database.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground at Vulert Scanner without any signup.
If exploited, this vulnerability could lead to unauthorized access to sensitive data, data corruption, or even complete control over the database, posing significant risks to the integrity and confidentiality of your application.
Yes, a patch is available in version 5.0.3 of the Funadmin package. It is recommended to update to this version or later to mitigate the vulnerability.
If you cannot update immediately, implement input validation and sanitization on the affected endpoint as a temporary measure to reduce the risk of SQL injection attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for funadmin/funadmin.
