{"id":"CVE-2026-121610","kind":"vulnerability","aliases":["CVE-2026-121610"],"related":[],"title":"funadmin: SQL injection in frontend list endpoint lets attackers run queries","description":"A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"funadmin 7.1.0 has a SQL injection in Curd::selectList behind the frontend ajax index endpoint: the selectFields argument reaches a query unchecked. The CVE record says an exploit is public and the vendor did not respond; no fix is known. Whether the endpoint is reachable without login is not stated in the sources I could read.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"funadmin/funadmin","fixed":[],"affected":"7.1.0","ecosystem":"composer"}],"ecosystems":[],"tags":["composer","funadmin","package","php","self-hosted"],"not_affected_if":["endpoint-not-exposed","other-versions"],"how_to_check":"- Check the installed version in composer.lock / composer.json; the CVE record names funadmin 7.1.0 (unconfirmed whether other 7.1.0 release candidates are affected).\n- Review the code of Curd::selectList (app/common/traits/Curd.php) and the frontend ajax index route: if request-supplied selectFields is passed to the query field() call unchecked, you are exposed.\n- Also check access logs for requests to the frontend ajax index with selectFields[...] containing SQL functions such as extractvalue, sleep or union.","fix":"No vendor fix known. The vendor did not respond to the disclosure per the CVE record. Until one exists, block or restrict the frontend ajax index route at the web server/WAF, or patch Curd::selectList to allow-list column names from selectFields.","status":"open","published_at":"2026-11-04T02:17:20+00:00","first_seen_at":"2026-11-04T02:46:02+00:00","triaged_at":"2026-11-04T02:47:15+00:00","updated_at":"2026-11-04T02:49:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-04T02:47:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"funadmin: SQL injection in frontend list endpoint lets attackers run queries","impact":"high","summary":"funadmin 7.1.0 has a SQL injection flaw in the frontend list endpoint, where the selectFields argument is passed into a query without proper checks. A remote attacker can use it to read or alter database data, and a public exploit has been released.","audience":"businesses","category":"package","nicknames":[],"who_cares":["funadmin","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"database contents readable or altered by a remote attacker","analyst_note":"Confirm whether the frontend list endpoint is on by default and whether a vendor or upstream fix exists; the vendor did not respond to disclosure.","how_to_check":"- Check the installed funadmin version in the project's composer.json or release tag; `7.1.0` is the affected version.\n- Look at the Curd::selectList code path under /frontend/ajax/index to see whether selectFields is passed to the query unchecked.","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","endpoint-not-exposed"],"who_is_affected":"Teams running funadmin 7.1.0 with the frontend ajax endpoint reachable from the internet are exposed. The sources do not say whether the endpoint is on by default. Installations that do not expose that frontend path are unlikely to be reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4145,"output_tokens":549,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the frontend list endpoint is on by default and whether a vendor or upstream fix exists; the vendor did not respond to disclosure.","search":"'-121610':14A,17A '-2026':13A,16A '/frontend/ajax/index':100C '7.1.0':27B,90C 'ajax':38B 'argument':43B,111C 'attack':9A,118C,136C 'behind':35B 'compon':103C 'compos':19B 'contact':140C 'could':80B 'curd':33B,95C 'cve':12A,15A,49B 'disclosur':144C 'discov':87C 'earli':141C 'endpoint':7A,40B,68B,106C 'execut':121C 'exploit':53B,124C 'file':99C 'fix':63B 'flaw':84C 'frontend':5A,37B,104C 'funadmin':1A,20B,26B,89C 'funadmin/funadmin':18A 'function':94C 'host':25B 'impact':91C 'index':39B 'inject':3A,31B,116C 'known':65B 'let':8A 'list':6A,105C 'login':72B 'manipul':108C 'may':132C 'packag':21B 'php':22B 'public':55B,130C 'queri':11A,46B 'reach':44B 'reachabl':70B 'read':81B 'record':50B 'releas':127C 'remot':122C 'respond':61B,148C 'result':113C 'run':10A 'say':51B 'secur':83C 'selectfield':42B,112C 'selectlist':34B,96C 'self':24B 'self-host':23B 'sourc':78B 'sql':2A,30B,115C 'state':75B 'uncheck':47B 'use':134C 'vendor':58B,138C 'way':151C 'whether':66B 'without':71B","nicknames":[],"mitigations":[],"who_affected":"Teams running funadmin 7.1.0 with the frontend ajax endpoint reachable from the internet are exposed. The sources do not say whether the endpoint is on by default. Installations that do not expose that frontend path are unlikely to be reachable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["funadminfunadmin"],"ptokens":["funadmin"],"labels":["composer","funadmin","high","package","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T02:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121610","severity":null,"published_at":"2026-11-04T02:17:20+00:00","modified_at":"2026-11-04T02:17:20+00:00","first_seen_at":"2026-11-04T02:46:02+00:00","fetched_at":"2026-11-04T02:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121610:1622","url":null,"severity":null,"published_at":"2026-11-04T02:49:35+00:00","modified_at":"2026-11-04T02:49:35+00:00","first_seen_at":"2026-11-04T02:49:35+00:00","fetched_at":"2026-11-04T02:49:35+00:00","note":"Only NVD/VulDB-style record found; no vendor advisory, no public PoC link located, no fix. Same selectFields->Curd::selectList->think-orm field() sink was reported in older funadmin versions (issue #29, 5.0.2, admin-auth required there); GitHub releases page lists no 7.x tag. Default-on status of frontend endpoint not confirmed. Nothing marked verified."}],"documents":[{"id":63351,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121610","title":"NVD CVE-2026-121610","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":63352,"url":"https://github.com/funadmin/funadmin/issues/29","title":"funadmin #29: selectFields SQL injection in backend Auth (5.0.2), same Curd::selectList sink","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}