CVE-2025-14966: FastAdmin Backend Controller Backend.php selectpage sql injection
A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controller/Backend.php of the component Backend Controller. Executing a manipulation of the argument custom/searchField can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14966?
CVE-2025-14966 has a high severity rating due to its potential for SQL injection attacks.
How do I fix CVE-2025-14966?
To mitigate CVE-2025-14966, upgrade FastAdmin to a version later than 1.7.0.20250506.
What components are affected by CVE-2025-14966?
CVE-2025-14966 affects the Backend Controller of FastAdmin, specifically the selectpage function in Backend.php.
What type of vulnerability is CVE-2025-14966?
CVE-2025-14966 is an SQL injection vulnerability that allows for manipulation of database queries.
Who is impacted by CVE-2025-14966?
Any user running FastAdmin version up to 1.7.0.20250506 is at risk from the CVE-2025-14966 vulnerability.