CVE-2023-24780: 
PHP vulnerability analysis and mitigation

Funadmin v3.2.0 contains a SQL injection vulnerability identified as CVE-2023-24780. The vulnerability was discovered in the database management plugin, specifically affecting the id parameter at the /databases/table/columns endpoint. This security issue was reported on January 29, 2023 (GitHub Issue).

The vulnerability exists in the columns method within app\databases\controller\table.php. The security flaw occurs when the application directly retrieves the id parameter and concatenates it into SQL statements without proper sanitization, leading to SQL injection possibilities. The vulnerability can be exploited through the /databases/table/columns endpoint (GitHub Issue).

A successful exploitation of this SQL injection vulnerability could allow attackers to manipulate database queries, potentially leading to unauthorized access to database contents, modification of data, or execution of administrative operations on the database server (NVD).

The vulnerability can be exploited remotely by sending specially crafted requests to the affected endpoint. A proof of concept exploit has been publicly disclosed, demonstrating the vulnerability using SQLMap against the /databases/table/columns endpoint (GitHub Issue).