| Título | FastAdmin 1.x Remote Code Execution |
|---|
| Descrição | During an authorized security assessment of FastAdmin (v1.6.5.20260602 / v1.6.1.20250430), I identified that the official Database Management addon provides arbitrary SQL execution to authenticated administrators without any security boundary, and that FastAdmin ships its database configuration defaulting to the MySQL root account:
The shipped application/database.php and .env.sample templates default the database connection to username = root (with an empty password / root respectively), i.e. the MySQL superuser account with SUPER privilege.
After signing in to the backend, an administrator can install and open the official Database Management addon, which exposes an SQL console that accepts and executes arbitrary SQL statements with the application database account's privileges — there is no boundary limiting what an administrator can execute.
Since the application account is MySQL root by default, the administrator can run SET GLOBAL general_log_file to point MySQL's query log at a web-accessible PHP controller path, enable general_log, issue a SELECT containing PHP code, then trigger the generated controller through FastAdmin/ThinkPHP routing — achieving remote code execution.
The weakness is the combination of an unrestricted SQL execution surface (addon) and an insecure default database configuration (root account), which turns an authenticated backend account into full server RCE. |
|---|
| Fonte | ⚠️ https://github.com/baguette168/CVE/issues/2 |
|---|
| Utilizador | baguette168 (UID 94957) |
|---|
| Submissão | 16/08/2026 13h17 (há 1 mês) |
|---|
| Moderação | 28/09/2026 21h01 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 411145 [FastAdmin 1.6.1.20250430/1.6.5.20260602 Database Management application/database.php Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|