| 제목 | 苏州泛爱软件科技有限公司 FunAdmin 7.1.0 SQL Injection |
|---|
| 설명 | FunAdmin 7.1.0 contains an unauthenticated SQL injection vulnerability in the frontend AJAX list interface. User-controlled field-selection input is incorporated into a SQL SELECT clause without sufficient neutralization. A remote attacker without credentials can cause the application to evaluate attacker-supplied SQL expressions and return database contents, resulting in disclosure of sensitive information. |
|---|
| 원천 | ⚠️ https://github.com/shihuizhang-dazhi/MY-CVE/blob/main/FunAdmin%20%E5%89%8D%E5%8F%B0%E6%9C%AA%E6%8E%88%E6%9D%83%20SQL%20%E6%B3%A8%E5%85%A5.docx |
|---|
| 사용자 | dazhi (UID 87857) |
|---|
| 제출 | 2026. 10. 10. PM 04:13 (27 날 ago) |
|---|
| 모더레이션 | 2026. 11. 03. PM 05:26 (24 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 430447 [funadmin 7.1.0 Frontend List Endpoint /frontend/ajax/index Curd::selectList selectFields SQL 주입] |
|---|
| 포인트들 | 20 |
|---|