CVE-2025-14966
📋 TL;DR
This SQL injection vulnerability in FastAdmin's Backend Controller allows attackers to execute arbitrary SQL commands by manipulating the custom/searchField parameter in the selectpage function. Attackers can exploit this remotely to potentially access, modify, or delete database content. All FastAdmin installations up to version 1.7.0.20250506 are affected.
💻 Affected Systems
- FastAdmin
📦 What is this software?
Fastadmin by Fastadmin
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or deletion of critical application data
Likely Case
Unauthorized data access and extraction of sensitive information from the database
If Mitigated
Limited impact due to database permissions, input validation, or WAF protection
🎯 Exploit Status
Exploit details have been publicly disclosed, making weaponization likely
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0.20250507 or later
Vendor Advisory: https://note-hxlab.wetolink.com/share/1924AEdgGFYu
Restart Required: No
Instructions:
1. Update FastAdmin to version 1.7.0.20250507 or later. 2. Apply the patch to the application/common/controller/Backend.php file. 3. Verify the fix by testing the selectpage function.
🔧 Temporary Workarounds
Input Validation Workaround
allAdd input validation for the custom/searchField parameter to prevent SQL injection
Modify application/common/controller/Backend.php to validate and sanitize custom/searchField input
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting the selectpage endpoint
- Restrict network access to the FastAdmin backend interface to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check FastAdmin version in admin panel or via version file. If version is ≤1.7.0.20250506, system is vulnerable.Check Version:
Check /application/config/version.php or admin panel version displayVerify Fix Applied:
Test the selectpage function with malicious input in custom/searchField parameter to ensure SQL injection is prevented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by selectpage requests
- Requests with suspicious custom/searchField parameters
Network Indicators:
- HTTP POST requests to /admin/backend/selectpage with SQL injection patterns in parameters
SIEM Query:
source="web_logs" AND uri="/admin/backend/selectpage" AND (param="custom/searchField" AND value MATCHES "(?i)(union|select|from|where|or|and|sleep|benchmark|'|\")")