CVE-2023-24781
📋 TL;DR
Funadmin v3.2.0 contains a SQL injection vulnerability in the selectFields parameter at /member/MemberLevel.php. This allows attackers to execute arbitrary SQL commands on the database. Any organization running Funadmin v3.2.0 is affected.
💻 Affected Systems
- Funadmin
📦 What is this software?
Funadmin by Funadmin
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining
Likely Case
Database information disclosure, authentication bypass, or privilege escalation
If Mitigated
Limited impact with proper input validation and parameterized queries in place
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized and this appears to be straightforward to exploit
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.2.1 or later
Vendor Advisory: https://github.com/funadmin/funadmin/issues/8
Restart Required: No
Instructions:
1. Backup your current installation. 2. Download the latest version from the official repository. 3. Replace the vulnerable MemberLevel.php file. 4. Verify the fix by testing the selectFields parameter.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to reject malicious SQL characters in the selectFields parameter
Modify MemberLevel.php to sanitize the selectFields parameter before processing
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule to detect and block SQL injection attempts in selectFields parameter
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for all database operations
- Restrict database user permissions to minimum required access
🔍 How to Verify
Check if Vulnerable:
Test the selectFields parameter at /member/MemberLevel.php with SQL injection payloads like ' OR '1'='1Check Version:
Check the Funadmin version in configuration files or admin panelVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- SQL syntax errors in application logs
Network Indicators:
- HTTP requests with SQL keywords in selectFields parameter
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (selectFields CONTAINS "UNION" OR selectFields CONTAINS "SELECT" OR selectFields CONTAINS "OR 1=1")