CVE-2024-48224: 
PHP vulnerability analysis and mitigation

Funadmin v5.0.2 contains an arbitrary file read vulnerability in the /curd/index/editfile path. The vulnerability was discovered and reported on September 16, 2024, affecting the Funadmin content management system (GitHub Issue).

The vulnerability exists in the editfile method within funadmin\app\curd\controller\Index.php. The issue stems from improper input validation where the id parameter value is directly concatenated into the file parameter and then read using file_get-contents function, enabling arbitrary file reading. The vulnerability has been assigned a CVSS v3.1 base score of 4.9 (MEDIUM) by NIST with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, while CISA-ADP assessed it with a higher score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows authenticated administrators to read arbitrary files on the system, including sensitive files such as SQL files and files across directories. An attacker can access files both within the application directory and outside of it through directory traversal (GitHub Issue).