CVE-2023-24774: SQL Injection Vulnerability in Funadmin
Summary
CVE-2023-24774: Funadmin vulnerable to SQL injection. Affects funadmin/funadmin versions < 3.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Funadmin is a package available on Packagist that provides administrative functionality for web applications. It is designed to simplify the process of creating and managing admin panels. The package is vulnerable to a SQL injection attack due to a flaw in the selectFields parameter of the Auth.php controller. This vulnerability allows an attacker to manipulate the SQL query and potentially gain unauthorized access to the database.
Vulnerability Detail
The SQL injection vulnerability in Funadmin v3.2.0 allows an attacker to inject malicious SQL code through the selectFields parameter. By exploiting this vulnerability, an attacker can modify the SQL query and perform unauthorized actions on the database, such as extracting sensitive information, modifying data, or executing arbitrary SQL commands. This vulnerability has a severity rating of CRITICAL (CVSS score: 9.8) and is classified under CWE-89 (SQL Injection).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize and validate user input before using it in SQL queries. This can be done by using appropriate sanitization functions or libraries specific to the programming language being used. It is important to thoroughly test the workaround to ensure it effectively mitigates the vulnerability.
Conclusion
The SQL injection vulnerability in Funadmin v3.2.0 poses a critical security risk, allowing attackers to execute arbitrary SQL commands and potentially compromise the integrity and confidentiality of the application's database. It is crucial to update Funadmin to the latest version and implement proper input validation and sanitization to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for funadmin/funadmin →
FAQ
This vulnerability allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access, data manipulation, or information disclosure.
Versions 0 to 3.2.0 of Funadmin are affected by this SQL injection vulnerability.
Yes, the latest version of Funadmin includes a patch for this SQL injection vulnerability. It is recommended to update to the latest version to mitigate the risk.
At the time of this report, there are no known public exploits available for this vulnerability. However, it is important to promptly apply the patch to prevent any potential exploitation.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this SQL injection vulnerability in Funadmin.
References
Related vulnerabilities
Recent vulnerabilities recorded for funadmin/funadmin.
