---
id: "CVE-2026-121610"
kind: "vulnerability"
aliases: ["CVE-2026-121610"]
title: "funadmin: SQL injection in frontend list endpoint lets attackers run queries"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "funadmin/funadmin", "fixed": [], "affected": "7.1.0", "ecosystem": "composer"}]
ecosystems: []
tags: ["composer", "funadmin", "package", "php", "self-hosted"]
not_affected_if: ["endpoint-not-exposed", "other-versions"]
published_at: "2026-11-04T02:17:20+00:00"
first_seen_at: "2026-11-04T02:46:02+00:00"
updated_at: "2026-11-04T02:49:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121610", "first_seen_at": "2026-11-04T02:46:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T02:49:35+00:00"}]
---

# funadmin: SQL injection in frontend list endpoint lets attackers run queries

funadmin 7.1.0 has a SQL injection in Curd::selectList behind the frontend ajax index endpoint: the selectFields argument reaches a query unchecked. The CVE record says an exploit is public and the vendor did not respond; no fix is known. Whether the endpoint is reachable without login is not stated in the sources I could read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:funadmin/funadmin affected 7.1.0 fixed ?

## How to check

- Check the installed version in composer.lock / composer.json; the CVE record names funadmin 7.1.0 (unconfirmed whether other 7.1.0 release candidates are affected).
- Review the code of Curd::selectList (app/common/traits/Curd.php) and the frontend ajax index route: if request-supplied selectFields is passed to the query field() call unchecked, you are exposed.
- Also check access logs for requests to the frontend ajax index with selectFields[...] containing SQL functions such as extractvalue, sleep or union.

## Fix

No vendor fix known. The vendor did not respond to the disclosure per the CVE record. Until one exists, block or restrict the frontend ajax index route at the web server/WAF, or patch Curd::selectList to allow-list column names from selectFields.

## Timeline

- 2026-11-04T02:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121610
- 2026-11-04T02:49:35+00:00 analyst — Only NVD/VulDB-style record found; no vendor advisory, no public PoC link located, no fix. Same selectFields->Curd::selectList->think-orm field() sink was reported in older funadmin versions (issue #29, 5.0.2, admin-auth required there); GitHub releases page lists no 7.x tag. Default-on status of frontend endpoint not confirmed. Nothing marked verified.

## Documents

- [describes] NVD CVE-2026-121610 https://nvd.nist.gov/vuln/detail/CVE-2026-121610
- [mentions] funadmin #29: selectFields SQL injection in backend Auth (5.0.2), same Curd::selectList sink https://github.com/funadmin/funadmin/issues/29

## From the sources

A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_