| Title | 苏州泛爱软件科技有限公司 FunAdmin 7.1.0 SQL Injection |
|---|
| Description | FunAdmin 7.1.0 contains an unauthenticated SQL injection vulnerability in the frontend AJAX list interface. User-controlled field-selection input is incorporated into a SQL SELECT clause without sufficient neutralization. A remote attacker without credentials can cause the application to evaluate attacker-supplied SQL expressions and return database contents, resulting in disclosure of sensitive information. |
|---|
| Source | ⚠️ https://github.com/shihuizhang-dazhi/MY-CVE/blob/main/FunAdmin%20%E5%89%8D%E5%8F%B0%E6%9C%AA%E6%8E%88%E6%9D%83%20SQL%20%E6%B3%A8%E5%85%A5.docx |
|---|
| User | dazhi (UID 87857) |
|---|
| Submission | 10/10/2026 16:13 (25 days ago) |
|---|
| Moderation | 11/03/2026 17:26 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 430447 [funadmin 7.1.0 Frontend List Endpoint /frontend/ajax/index Curd::selectList selectFields sql injection] |
|---|
| Points | 20 |
|---|