CVE-2025-14966
Remote SQL Injection in FastAdmin Backend Controller (selectpage
Publication date: 2025-12-19
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fastadmin | fastadmin | 1.7.0.20250506 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-14966 is a time-based blind SQL injection vulnerability in FastAdmin versions up to 1.7.0.20250506. It occurs in the selectpage() function of the Backend controller, specifically due to improper sanitization of the searchField parameter. This parameter is used directly in SQL WHERE clauses without adequate validation, allowing authenticated backend users to inject malicious SQL code. Exploiting this flaw enables attackers to execute arbitrary SQL commands remotely, extract sensitive database information, and potentially escalate privileges. [1, 2, 3, 4]
How can this vulnerability impact me? :
This vulnerability can allow attackers with backend authentication to extract sensitive data such as usernames, password hashes, tokens, and database structure details. It can lead to unauthorized access to all data stored in the database and potential privilege escalation by obtaining admin credentials. The attack can be performed remotely and may result in compromise of confidentiality, integrity, and availability of the affected system. [1, 2, 3, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to exploit the time-based blind SQL injection in the `searchField` parameter of the `selectpage()` function in the Backend controller. Detection involves authenticating to the backend/admin panel and sending crafted GET requests with payloads that induce time delays, such as `searchField[]=1)and(sleep(2))and(1`. Monitoring for response delays (~2 seconds) indicates successful injection and confirms the vulnerability. Additionally, Google dorking using queries like `inurl:application/common/controller/Backend.php` can help identify potentially vulnerable targets. Example detection steps include: 1) Log into the admin panel with valid credentials. 2) Send a GET request to the vulnerable endpoint with the `searchField` parameter containing a payload like `1)and(sleep(2))and(1`. 3) Include the header `X-Requested-With: XMLHttpRequest` to trigger the vulnerable code path. 4) Observe if the response is delayed by approximately 2 seconds, indicating vulnerability. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing strict validation on the `searchField` parameter in the `Backend.php` file. This validation should allow only alphanumeric characters, underscores, and dots, for example by using a regex filter such as `/^[a-zA-Z_][a-zA-Z0-9_\.]*$/`. If the validation fails or results in an empty array, default the parameter to a safe field like `id`. Additionally, restrict access to the backend to trusted users only, as exploitation requires authenticated backend access. If possible, replace or update the affected FastAdmin component to a version that addresses this vulnerability or use an alternative product. [2, 1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss the impact of CVE-2025-14966 on compliance with common standards and regulations such as GDPR or HIPAA. However, since the vulnerability allows extraction of sensitive data including usernames, password hashes, tokens, and database structure, it could potentially lead to unauthorized data disclosure and compromise of confidentiality and integrity. Such data breaches may result in non-compliance with data protection regulations that require safeguarding personal and sensitive information. No direct statements about compliance impact are provided. [1, 2, 3, 4]