CVE-2023-24780
📋 TL;DR
Funadmin v3.2.0 contains a SQL injection vulnerability in the id parameter at /databases/table/columns endpoint. This allows attackers to execute arbitrary SQL commands on the database. Anyone running Funadmin v3.2.0 is affected.
💻 Affected Systems
- Funadmin
📦 What is this software?
Funadmin by Funadmin
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Database information disclosure, data manipulation, and potential authentication bypass.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions.
🎯 Exploit Status
SQL injection is well-understood with many automated tools available. Requires authentication to access the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.2.1 or later
Vendor Advisory: https://github.com/funadmin/funadmin/issues/6
Restart Required: Yes
Instructions:
1. Backup your database and application files. 2. Download the latest version from the official repository. 3. Replace the vulnerable files with patched versions. 4. Restart the application server.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept numeric values for the id parameter
Modify the controller handling /databases/table/columns to validate id parameter as integer
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL keywords in id parameter
🧯 If You Can't Patch
- Restrict access to /databases/table/columns endpoint using network ACLs or authentication requirements
- Implement database user privilege restrictions to limit potential damage from SQL injection
🔍 How to Verify
Check if Vulnerable:
Check if running Funadmin v3.2.0 and test the /databases/table/columns endpoint with SQL injection payloads in id parameterCheck Version:
Check package.json or version file in Funadmin installation directoryVerify Fix Applied:
Verify version is v3.2.1 or later and test that SQL injection payloads no longer work📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from application user
- Multiple failed login attempts followed by database access patterns
- SQL error messages in application logs
Network Indicators:
- HTTP requests to /databases/table/columns with SQL keywords in parameters
- Unusual database traffic patterns from application server
SIEM Query:
source="web_logs" AND uri_path="/databases/table/columns" AND (param_id CONTAINS "UNION" OR param_id CONTAINS "SELECT" OR param_id CONTAINS "INSERT" OR param_id CONTAINS "DELETE")