Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-48218: Funadmin v5.0.2: Unauthorized data access through web input

CVE-2024-48218 · published 2 years ago

Summary

A weakness in Funadmin version 5.0.2 allows an attacker to potentially access sensitive data or execute unauthorized actions by manipulating input on the /curd/table/list page. This could lead to unauthorized changes or viewing of data. To fix this, update to the latest version of Funadmin or apply the recommended patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	funadmin	funadmin	<= 5.0.2
–	funadmin	funadmin	5.0.2 `cpe:2.3:a:funadmin:funadmin:5.0.2:::::::*`

Original advisory text

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.

References

https://github.com/advisories/GHSA-h4px-9vmp-p7pv
https://nvd.nist.gov/vuln/detail/CVE-2024-48218 Vendor Advisory
https://github.com/funadmin/funadmin/issues/21 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48218... Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

8.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published25 Oct 2024

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-h4px-9vmp-p7pv · GHSA

CVE-2024-48218 · NVD

CVE-2024-48218 · OSV

Track software like this

Free during beta