-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The Table.php delete action directly interpolates user-controlled 'id' into SQL without proper validation, as shown in the reproduction steps. 2) The getSystemTable blacklist in common.php fails to account for injection techniques, evidenced by the attacker bypassing restrictions using 'admin;'. Together, these allow unauthorized deletion of core system tables (e.g., fun_admin), causing DOS. The GitHub issue explicitly references these components and demonstrates exploitability through HTTP requests targeting these functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| funadmin/funadmin | composer | <= 5.0.2 |
PHPPHPOngoing coverage of React2Shell