funadmin: XSS through Value argument in Backend Interface component

The XSS vulnerability in funadmin allows an attacker to inject arbitrary JavaScript code into the application's web pages. This code can then be executed in the context of a user's browser, potentially allowing the attacker to steal session cookies, redirect users to malicious websites, or deface the application's interface. The remote nature of the vulnerability means an attacker does not need to be on the same network as the application to exploit it. Given the public disclosure, the risk of exploitation is elevated, particularly if users are not promptly updated.

Organizations using funadmin for backend management interfaces are at risk, particularly those running versions prior to the security fix. Shared hosting environments where multiple users share the same funadmin instance are also at increased risk, as an attacker could potentially exploit the vulnerability through another user's account.

• php / server:

grep -r "Value = javascript:" /var/www/funadmin/

• generic web:

curl -I http://your-funadmin-site.com/app/backend/view/index/index.html | grep -i content-security-policy

1. 2026-02-22Disclosure

   disclosure

1. आरक्षित2026-02-20
2. प्रकाशित2026-02-22
3. संशोधित2026-02-26
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-2897 is to upgrade funadmin to a version that includes the security fix. As no fixed version is specified, thoroughly review the vendor's release notes for the latest stable version. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the 'Value' argument within the Backend Interface to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection.

अंतिम अपडेट

7.0.29 महीने पहले