Executive Summary

CVE-2025-14966 is a time-based blind SQL injection vulnerability in FastAdmin versions up to 1.7.0.20250506. It occurs in the selectpage() function of the Backend controller, specifically due to improper sanitization of the searchField parameter. This parameter is used directly in SQL WHERE clauses without adequate validation, allowing authenticated backend users to inject malicious SQL code. Exploiting this flaw enables attackers to execute arbitrary SQL commands remotely, extract sensitive database information, and potentially escalate privileges. [1, 2, 3, 4]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with backend authentication to extract sensitive data such as usernames, password hashes, tokens, and database structure details. It can lead to unauthorized access to all data stored in the database and potential privilege escalation by obtaining admin credentials. The attack can be performed remotely and may result in compromise of confidentiality, integrity, and availability of the affected system. [1, 2, 3, 4]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the time-based blind SQL injection in the `searchField` parameter of the `selectpage()` function in the Backend controller. Detection involves authenticating to the backend/admin panel and sending crafted GET requests with payloads that induce time delays, such as `searchField[]=1)and(sleep(2))and(1`. Monitoring for response delays (~2 seconds) indicates successful injection and confirms the vulnerability. Additionally, Google dorking using queries like `inurl:application/common/controller/Backend.php` can help identify potentially vulnerable targets. Example detection steps include: 1) Log into the admin panel with valid credentials. 2) Send a GET request to the vulnerable endpoint with the `searchField` parameter containing a payload like `1)and(sleep(2))and(1`. 3) Include the header `X-Requested-With: XMLHttpRequest` to trigger the vulnerable code path. 4) Observe if the response is delayed by approximately 2 seconds, indicating vulnerability. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing strict validation on the `searchField` parameter in the `Backend.php` file. This validation should allow only alphanumeric characters, underscores, and dots, for example by using a regex filter such as `/^[a-zA-Z_][a-zA-Z0-9_\.]*$/`. If the validation fails or results in an empty array, default the parameter to a safe field like `id`. Additionally, restrict access to the backend to trusted users only, as exploitation requires authenticated backend access. If possible, replace or update the affected FastAdmin component to a version that addresses this vulnerability or use an alternative product. [2, 1]

Useful 0 Not Useful 0

Compliance Impact

The provided resources do not explicitly discuss the impact of CVE-2025-14966 on compliance with common standards and regulations such as GDPR or HIPAA. However, since the vulnerability allows extraction of sensitive data including usernames, password hashes, tokens, and database structure, it could potentially lead to unauthorized data disclosure and compromise of confidentiality and integrity. Such data breaches may result in non-compliance with data protection regulations that require safeguarding personal and sensitive information. No direct statements about compliance impact are provided. [1, 2, 3, 4]

Useful 0 Not Useful 0