funadmin vulnerabilities

A security flaw was discovered in funadmin 7.1.0 in the Curd::selectList function of /frontend/ajax/index (Frontend List Endpoint component). Manipulating the selectFields argument results in SQL injection. The attack can be executed remotely and the exploit has been released publicly.

A flaw has been found in funadmin up to version 7.1.0-rc6, affecting the function UploadService::chunkUpload in the file app/common/service/UploadService.php. Manipulation of the argument File leads to unrestricted file uploads.

Versions 3.3.2 and 3.3.3 of funadmin are vulnerable to insecure file upload via plugin installation.