Funadmin vulnerable to SQL injection

CRITICAL 9.8CVE-2023-24774 · GHSA-jx2x-fg9p-7gc7 · Published 10/03/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
funadmin/funadmin Packagist	`≤ 3.2.0`	No fix yet
funadmin funadmin	`= 3.2.0`	No fix yet

Description

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.

NVD description

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.