EUVD-2026-92704
GHSA-3722-82pp-q7c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach FineAdmin admin Button-list endpoint
-
ExploitInject SQL via field/order sort parameter
-
ExecutionBackend concatenates value into ORDER BY query
-
ImpactExtract sensitive database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the /Permissions/Button/List request handled by ButtonService.GetListByFilter() and supplying a malicious value in the field/order (sort) parameter, which is injected into a SQL ORDER BY clause. The input CVSS marks this PR:N (no authentication), but the endpoint is an administrative permissions/button-management function, so realistically the attacker likely needs an authenticated admin or back-office session unless the panel is exposed without access control - this is the key limiting factor defenders should verify. No special non-default configuration is otherwise implied, and no user interaction is required (UI:N). Limited further by the product's tiny deployment footprint (obscure FineAdmin v1.0). |
| Impact | Signals conflict sharply, so raw CVSS should not drive prioritization here. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) and the SSVC framework (Automatable: yes, Technical Impact: total) describe a textbook unauthenticated, network-reachable SQL injection with full database impact. However, the EPSS score is very low (0.15%, 4th percentile) and the vulnerability is NOT on the CISA KEV list, indicating no observed real-world exploitation despite a public PoC. There is also a credibility gap on the PR:N claim: the vulnerable endpoint (/Permissions/Button/List, ButtonService.GetListByFilter) is an administrative permissions/back-office function that in practice would normally sit behind authentication, so the MITRE-assigned PR:N (unauthenticated) may be optimistic - verify the actual auth gating against the product before trusting the 9.8. Finally, FineAdmin v1.0 appears to be an obscure open-source .NET MVC project with negligible deployment, so the practical blast radius is small. Net: a genuinely high-severity code flaw, but low real-world urgency - treat as 'fix if deployed' rather than emergency patch. |
| Exploit ScenarioDerived | An attacker able to reach the FineAdmin admin interface submits a crafted value in the field/order sort parameter of the Button list request (/Permissions/Button/List), which ButtonService.GetListByFilter() concatenates directly into a SQL ORDER BY clause. Because sort-column names are rarely parameterizable, the injected SQL executes and the attacker extracts sensitive database contents. A public proof-of-concept exists on GitHub (SSVC Exploitation: poc), lowering the skill barrier, and CVSS AC:L indicates the attack is reliable once the endpoint is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
SQL injection in FineAdmin v1.0 allows attackers to reach the /Permissions/Button/List endpoint and inject crafted SQL through the field/order (sort) parameter handled by ButtonService.GetListByFilter(), exposing sensitive database contents. Publicly available exploit code exists (an author-published proof-of-concept write-up is referenced), but there is no confirmed active exploitation (CISA KEV), and EPSS is very low at 0.15% (4th percentile), reflecting the product's obscure, small deployment footprint. The vendor-supplied CVSS of 9.8 (PR:N) conflicts with the assessed vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, which assumes the attacker realistically needs an authenticated admin or back-office session because the affected function is an administrative permissions/button-management feature - that authentication prerequisite is the key limiting factor defenders should verify rather than the headline score.
RemediationAI
No vendor-released patch identified at time of analysis - no fix version, commit, or advisory from the FineAdmin maintainers appears in the available references, so remediation must rely on compensating controls until an upstream fix ships. The most effective control is to remove the injection surface itself: replace the concatenated ORDER BY construction in ButtonService.GetListByFilter() with a strict allowlist mapping of permitted sort field names and a normalized asc/desc direction, rejecting any value outside that set - this is the only fix that fully closes the issue, and its trade-off is a small development effort and loss of arbitrary (unlisted) sort columns. Until that code change is deployed, restrict network and session access to /Permissions/Button/List so only trusted, fully authenticated administrator sessions can reach it, and verify that the admin panel is not internet-exposed without access control, since the independent assessment treats authentication as the primary mitigating factor (vendor CVSS claims PR:N, which should be validated against the actual deployment). Additional short-term measures include a WAF rule that blocks sort/order parameters containing SQL metacharacters (quotes, comment markers, UNION keywords) - noting the trade-off of false positives and trivial bypass via obfuscation - and database hardening such as running the application with a least-privilege account and disabling stacked queries where the driver permits. Monitor the referenced NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-88424) and the discoverer's GitHub repository for a patched release, and treat the public proof-of-concept as a reminder that exploitation is automatable (SSVC: Automatable=yes) once the endpoint is reachable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection arising from unsafe construction of a dynamic ORDER BY clause. ButtonService.GetListByFilter() takes the field/order (sort) parameters from the /Permissions/Button/List request and concatenates them into the SQL statement's ORDER BY clause rather than binding them as parameters, which is a recurring failure mode because SQL identifiers (column and sort-direction names) generally cannot be parameterized using standard prepared-statement placeholders. Because the DBMS executes the resulting statement with the application's database privileges, an attacker who controls the sort value can append or restructure predicates to read arbitrary tables - for example user, credential, and permission records - and, depending on the backend driver and stacked-query support, potentially extend the impact. The CPE record supplied is a placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and provides no vendor/product normalization, so the only reliable identification of the affected component is the product name/version FineAdmin v1.0. Note that the ORDER BY injection point yields full confidentiality impact (C:H) while integrity impact is assessed as limited (I:L), lower than the vendor's I:H claim, and availability is not impacted (A:N) - an important nuance when comparing the vendor and independent scores.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Admin permissions endpoint implies an authenticated session (PR:L); injection is reliable (AC:L); described impact is sensitive data disclosure (C:H) with limited tampering (I:L) and no availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements.
Executive ViewAI
FineAdmin v1.0 is affected by a SQL injection in its administrative permissions/button-management endpoint, creating a potential sensitive database exposure for organizations running this application. The assessed attack path requires an authenticated back-office session, and the product appears to have a small deployment footprint, so enterprise-wide impact is likely limited; however, publicly available exploit code exists for this critical-severity flaw. Leadership should direct teams to confirm whether FineAdmin v1.0 is deployed, restrict administrative access, and prepare for a vendor patch because no vendor-released patch is currently identified.
No vendor-released patch identified at time of analysis; restrict access to the affected administrative endpoint and permissions/button-management feature, enforce authentication and least privilege, deploy WAF rules to block SQL injection in field/order parameters, monitor logs for anomalous sort queries, and isolate FineAdmin v1.0 from untrusted networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB