FastAdmin vulnerabilities

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to execute arbitrary code via the application/common/controller/Backend.php component.

A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602 in the file application/database.php of the Database Management component. Manipulation leads to execution with unnecessary privileges. The attack can be launched remotely, and the exploit is public.

A security vulnerability was detected in FastAdmin up to 1.2.0.20210401_beta. The affected function is register/login in the file application/index/controller/User.php (User Controller component). Manipulation of the url argument leads to cross-site scripting. The attack may be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 1.2.1.20210731_beta addresses this issue.

A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controller/Backend.php of the component Backend Controller. Executing a manipulation of the argument custom/searchField can lead to SQL injection. It is possible to launch the attack remotely, and the exploit has been publicly disclosed.