CVE-2026-75336 in Funiture
Summary
by MITRE • 08/27/2026
Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Funiture version 1.0.0 represents a critical security flaw within its administrative backend infrastructure, specifically affecting the endpoints responsible for managing system tools. The affected paths are located at /sys/tool/select.json and /sys/tool/update.json. These interfaces serve as the primary mechanism for administrators to query existing tool configurations or modify them via JSON-based requests. The core issue lies in how these endpoints process user-supplied input before constructing database queries. Instead of employing parameterized statements or prepared statements, which are standard practices for preventing injection attacks, the application concatenates raw input directly into SQL command strings. This architectural decision creates a classic SQL Injection vector that allows an attacker to manipulate the underlying database logic through maliciously crafted HTTP requests.
From a technical perspective, this flaw aligns with CWE-89, commonly known as Improper Neutralization of Special Elements used in an SQL Command. The vulnerability arises because the backend does not adequately sanitize or validate input parameters before they are executed by the database engine. An attacker can exploit this by injecting SQL syntax into fields such as tool identifiers, configuration values, or search criteria within the JSON payload. By carefully crafting these payloads, it is possible to bypass authentication checks, extract sensitive data from other tables, modify administrative configurations, or even execute operating system commands if the underlying database supports such features and has appropriate privileges enabled. The presence of this vulnerability in both selection and update endpoints significantly expands the attack surface, as an attacker can not only read arbitrary data but also alter critical system states by injecting destructive SQL statements like DROP TABLE or UPDATE operations on sensitive configuration tables.
The operational impact of this vulnerability is severe due to its location within a backend administrative interface. Typically, such interfaces are protected by authentication mechanisms; however, if credentials are compromised through phishing, brute force, or credential stuffing attacks, the attacker gains immediate access to these injection points. Once authenticated, the ability to perform SQL Injection allows for full database compromise. This can lead to the exfiltration of user data, including personally identifiable information and sensitive business logic configurations. Furthermore, because the update endpoint is also vulnerable, an attacker could alter system settings, potentially disabling security controls or creating backdoor accounts that persist even after the initial vulnerability is patched if not properly audited. In a broader context, this aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically when SQL injection leads to remote code execution via database features like xp_cmdshell in Microsoft SQL Server or similar functions in other RDBMS platforms.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices. The primary remediation is to refactor the backend code handling these endpoints to use parameterized queries or prepared statements exclusively. This ensures that user input is treated strictly as data rather than executable code, effectively neutralizing injection attempts regardless of content. Additionally, implementing strict input validation using allowlists for expected data types and formats can provide an additional layer of defense. It is also crucial to enforce the principle of least privilege by ensuring the database account used by the web application does not have administrative rights or permissions to execute system-level commands. Finally, deploying a Web Application Firewall with rules specifically tuned to detect SQL injection patterns in JSON payloads can help mitigate exploitation attempts while long-term code fixes are being developed and deployed. Regular security audits and penetration testing should be conducted to verify that similar vulnerabilities do not exist elsewhere in the application architecture.