| Titel | 苏州泛爱软件科技有限公司 FunAdmin 7.1.0 SQL Injection |
|---|
| Beschreibung | FunAdmin 7.1.0 contains an unauthenticated SQL injection vulnerability in the frontend AJAX list interface. User-controlled field-selection input is incorporated into a SQL SELECT clause without sufficient neutralization. A remote attacker without credentials can cause the application to evaluate attacker-supplied SQL expressions and return database contents, resulting in disclosure of sensitive information. |
|---|
| Quelle | ⚠️ https://github.com/shihuizhang-dazhi/MY-CVE/blob/main/FunAdmin%20%E5%89%8D%E5%8F%B0%E6%9C%AA%E6%8E%88%E6%9D%83%20SQL%20%E6%B3%A8%E5%85%A5.docx |
|---|
| Benutzer | dazhi (UID 87857) |
|---|
| Einreichung | 10.10.2026 16:13 (vor 27 Tagen) |
|---|
| Moderieren | 03.11.2026 17:26 (24 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 430447 [funadmin 7.1.0 Frontend List Endpoint /frontend/ajax/index Curd::selectList selectFields SQL Injection] |
|---|
| Punkte | 20 |
|---|