{"id":"CVE-2026-88424","published":"2026-10-05T19:17:26.053","lastModified":"2026-10-06T17:17:27.667","description":"FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/xuex86438-netizen/FineAdmin.Mvc-Pagination-Sort-Parameter-SQL-Injection-Permissions-Button-List-/blob/main/FineAdmin.Mvc%20Pagination%20Sort-Parameter%20SQL%20Injection%20%28/Permissions/Button/List%29","tags":[]},{"url":"https://github.com/xuex86438-netizen/FineAdmin.Mvc-Pagination-Sort-Parameter-SQL-Injection-Permissions-Button-List-/blob/main/FineAdmin.Mvc%20Pagination%20Sort-Parameter%20SQL%20Injection%20%28/Permissions/Button/List%29","tags":[]}],"exploitRefs":[{"url":"https://github.com/xuex86438-netizen/FineAdmin.Mvc-Pagination-Sort-Parameter-SQL-Injection-Permissions-Button-List-/blob/main/FineAdmin.Mvc%20Pagination%20Sort-Parameter%20SQL%20Injection%20%28/Permissions/Button/List%29","tags":[]},{"url":"https://github.com/xuex86438-netizen/FineAdmin.Mvc-Pagination-Sort-Parameter-SQL-Injection-Permissions-Button-List-/blob/main/FineAdmin.Mvc%20Pagination%20Sort-Parameter%20SQL%20Injection%20%28/Permissions/Button/List%29","tags":[]}],"hasPoc":true,"ai":{"summary":"FineAdmin v1.0 is vulnerable to SQL injection via the field/order parameter, allowing attackers to access sensitive database information.","exploitability":"Exploitation is relatively straightforward with a crafted SQL statement, requiring access to the endpoint.","blast_radius":"If exploited, attackers can access sensitive database information, potentially leading to data breaches and loss of confidentiality.","remediation":"Upgrade to FineAdmin v1.0.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","database","rce","critical"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:42:56.022Z"}}