CVE-2024-48230: 
PHP vulnerability analysis and mitigation

funadmin 5.0.2 contains a SQL Injection vulnerability in the index method of \backend\controller\auth\Auth.php, specifically through the parentField parameter. The vulnerability was discovered and reported on September 17, 2024 (GitHub Issue).

The vulnerability exists in the index method of funadmin\app\backend\controller\auth\Auth.php where the parentField parameter is processed without proper sanitization. The exploitation path involves the selectFields parameter being passed through the selectList method in funadmin\app\common\traits\Curd.php and ultimately to funadmin\vendor\topthink\think-orm\src\db\BaseQuery.php#field where it is concatenated into SQL queries without proper filtering. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 HIGH (NIST: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability allows an attacker with administrative access to perform SQL injection attacks against the backend database, potentially leading to unauthorized data access, modification, or deletion of database contents (NVD).