SQL Injection Vulnerability in FastAdmin by FastAdmin Team
CVE-2020-21667

7.2HIGH

Key Information:

Vendor

Fastadmin-tp6 Project

Status
Fastadmin-tp6
Vendor
CVE Published:
13 November 2020

What is CVE-2020-21667?

In FastAdmin version 1.0, an SQL injection vulnerability exists due to inadequate filtering of the 'table' parameter in app/admin/controller/Ajax.php. This flaw allows attackers to manipulate SQL queries, potentially leading to unauthorized access to sensitive data. Administrators are advised to apply necessary updates and implement input validation measures to safeguard their applications.

References

https://github.com/che-my/fastadmin-tp6/issues/2
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.