SQL Injection Vulnerability in Funadmin 5.0.2 from Funadmin
CVE-2024-48229

7.2HIGH

Key Information:

Vendor

Funadmin

Status
Funadmin
Vendor
CVE Published:
25 October 2024

What is CVE-2024-48229?

A SQL injection vulnerability exists in Funadmin version 5.0.2, specifically within the Curd one click command mode plugin. This flaw allows attackers to manipulate SQL queries by inserting malicious code, potentially leading to unauthorized access to sensitive data within the database. Exploitation of this vulnerability can result in data leakage, data corruption, or complete system compromise. Organizations using affected versions should prioritize mitigation strategies to safeguard their applications and data integrity.

References

https://github.com/funadmin/funadmin/issues/28

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.