CVE-2024-48225: Funadmin v5.0.2 Arbitrary File Deletion Vulnerability
Summary
CVE-2024-48225: SQL injection in funadmin. Affects funadmin/funadmin versions < 5.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Funadmin is a PHP-based content management system that allows users to manage their web applications easily. It offers features such as file management, user administration, and customizable templates. However, version 5.0.2 has been found to contain a critical vulnerability that could lead to unauthorized file deletion, potentially compromising the integrity of the application and its data.
Vulnerability Detail
The vulnerability in Funadmin v5.0.2 arises from improper input validation in the file deletion functionality located in the /curd/index/delfile endpoint. An attacker can exploit this flaw by crafting a malicious request that bypasses security checks, allowing them to delete arbitrary files on the server. This could lead to significant data loss, disruption of service, and potential exposure of sensitive information. The vulnerability is classified under CWE-89, which pertains to SQL injection, indicating that it may also allow for further exploitation through database manipulation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the /curd/index/delfile endpoint by implementing server-side access controls or by disabling the file deletion feature until the update can be applied. This can be done by modifying the server configuration or using .htaccess rules to deny access to that specific endpoint.
Conclusion
The arbitrary file deletion vulnerability in Funadmin v5.0.2 poses significant risks to users of the application. It is crucial to update to the latest version to mitigate these risks. Additionally, users can utilize Vulert to monitor and alert for open-source vulnerabilities in their software, ensuring ongoing security.
See every vulnerability recorded for funadmin/funadmin →
FAQ
CVE-2024-48225 is a vulnerability identified in Funadmin v5.0.2 that allows for arbitrary file deletion due to improper input validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized file deletion, potential data loss, service disruption, and exposure of sensitive information.
Yes, updating to the latest version of Funadmin will patch this vulnerability. Use composer update funadmin/funadmin to apply the update.
If an immediate update is not possible, implement access controls to restrict access to the vulnerable endpoint as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for funadmin/funadmin.
