Description
A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-11-04
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Apply Vendor Patch
AI Analysis

Impact

This vulnerability is a parameterized injection flaw that allows an attacker to supply arbitrary SQL through the selectFields argument of a frontend endpoint. The flaw is a classic SQL injection described by CWE-89 and a code injection weakness categorized as CWE-74. Remote execution of malicious SQL queries can lead to data exfiltration, data modification or even deletion through the vulnerable endpoint, impacting the confidentiality, integrity, and availability of the underlying database.

Affected Systems

The affected product is funadmin version 7.1.0. The flaw resides in the Curd::selectList function located in /frontend/ajax/index of the Frontend List Endpoint. No other versions are currently documented as vulnerable.

Risk and Exploitability

The CVSS score of 6.9 reflects a moderate severity that combines network accessibility with potential data compromise. EPSS is not available, so the exploitation likelihood cannot be quantified, and the issue is not listed in the CISA KEV catalog. The vulnerability is exploitable remotely, meaning any client that can reach the endpoint can trigger the injection. Attackers could gain unauthorized database access if the database user has elevated privileges, while weaker privileges could limit them to read-only operations.

Generated by OpenCVE AI on November 4, 2026 at 08:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch for funadmin 7.1.0 once it becomes available.
  • Sanitize or whitelist the selectFields parameter to ensure only allowed values are accepted, preventing arbitrary SQL injection.
  • Configure the database account used by the application with the least privileges required to perform necessary operations so that a successful injection would have limited impact.

Generated by OpenCVE AI on November 4, 2026 at 08:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 02:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title funadmin Frontend List Endpoint index selectList sql injection
First Time appeared Funadmin
Funadmin funadmin
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*
Vendors & Products Funadmin
Funadmin funadmin
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Funadmin Funadmin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-04T02:00:20.150Z

Reserved: 2026-11-03T16:26:46.898Z

Link: CVE-2026-121610

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-04T02:17:20.470

Modified: 2026-11-04T02:17:20.633

Link: CVE-2026-121610

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T08:45:11Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')