| Título | 苏州泛爱软件科技有限公司 FunAdmin 7.1.0 SQL Injection |
|---|
| Descrição | FunAdmin 7.1.0 contains an unauthenticated SQL injection vulnerability in the frontend AJAX list interface. User-controlled field-selection input is incorporated into a SQL SELECT clause without sufficient neutralization. A remote attacker without credentials can cause the application to evaluate attacker-supplied SQL expressions and return database contents, resulting in disclosure of sensitive information. |
|---|
| Fonte | ⚠️ https://github.com/shihuizhang-dazhi/MY-CVE/blob/main/FunAdmin%20%E5%89%8D%E5%8F%B0%E6%9C%AA%E6%8E%88%E6%9D%83%20SQL%20%E6%B3%A8%E5%85%A5.docx |
|---|
| Utilizador | dazhi (UID 87857) |
|---|
| Submissão | 10/10/2026 16h13 (há 25 dias) |
|---|
| Moderação | 03/11/2026 17h26 (24 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 430447 [funadmin 7.1.0 Frontend List Endpoint /frontend/ajax/index Curd::selectList selectFields Injeção SQL] |
|---|
| Pontos | 20 |
|---|