FineAdmin V1.0 contains an SQL injection flaw that can be triggered through the `field` and `order` parameters found on its paginated list endpoints. An attacker who can supply arbitrary content to these parameters may trigger the database engine to execute arbitrary SQL statements, which can lead to gaining control over the application or the underlying database. The vulnerability is a classic input validation failure, enabling the execution of unknown code in the context of the vulnerable application.

FineAdmin version 1.0 is affected. No other versions are listed, and the vendor/vendor information is not supplied.

The EPSS score is <1%, which indicates a low probability of exploitation. The CVSS score of 9.8 reflects the severity of this remote code execution vulnerability. Since the vulnerability is not in the CISA KEV catalog, it has not yet been widely reported as exploited. The most likely attack vector is via a simply crafted HTTP request that includes malicious `field` or `order` values. The description does not specify whether authentication is required; it is inferred that remote exploitation may be possible without authentication. The impact is the potential loss of confidentiality, integrity, and availability of the database and the application.