Description

Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T23:17:18.787Z",
  "pubdate": "2026-08-26T23:17:18.787Z",
  "executiveSummary": "Funiture 1.0.0 is susceptible to SQL Injection vulnerabilities within its backend administrative tool interfaces, specifically targeting the /sys/tool/select.json and /sys/tool/update.json endpoints.\nThis vulnerability arises due to improper sanitization and neutralization of user-supplied input before it is incorporated into database queries.\nSuccessful exploitation allows an unauthenticated or authenticated attacker to inject arbitrary SQL commands into the backend database, potentially leading to unauthorized data exfiltration, modification of database contents, or complete compromise of the underlying data store.\nGiven that these endpoints appear to manage administrative tools, an attacker could potentially escalate privileges or gain persistent access to sensitive application data.\nThe risk is considered critical, as it bypasses standard application-layer security controls and directly interacts with the database management system.\nImmediate remediation is required to sanitize inputs and implement parameterized queries to prevent the execution of malicious SQL statements.",
  "technicalDetails": "The vulnerability exists within the backend tool management system of Funiture 1.0.0, specifically impacting the /sys/tool/select.json and /sys/tool/update.json API endpoints.\nThe root cause of this vulnerability is the failure of the application logic to correctly validate and parameterize user input before processing it within dynamic SQL queries.\nWhen a request is submitted to these endpoints, the backend likely constructs database queries using concatenated user input, which allows an attacker to manipulate the query structure.\nFor the /sys/tool/select.json endpoint, an attacker can supply malicious input via query parameters or JSON request bodies designed to alter the WHERE or SELECT clauses. By injecting SQL syntax such as 'OR 1=1', an attacker could bypass authentication checks, retrieve unauthorized records, or dump the entire database contents via UNION-based SQL injection techniques.\nFor the /sys/tool/update.json endpoint, the vulnerability is particularly severe, as the interface is designed to perform update operations. An attacker could inject statements to modify existing records, change administrative credentials, or escalate their own privilege levels within the database. Furthermore, if the database configuration permits, an attacker might leverage advanced injection techniques, such as stacked queries or operating system command execution (depending on database permissions and underlying drivers), to achieve remote code execution (RCE) on the database server.\nThe attack flow typically involves the following steps: 1. Identification of the vulnerable parameters within the JSON structure expected by the API endpoints. 2. Crafting a malicious payload containing SQL control characters to break out of the intended data context. 3. Sending the crafted request to the endpoint. 4. Observing the application response to confirm successful query manipulation or error-based information disclosure. 5. Iterative exploitation to extract data or modify the database state.\nThis flaw is critical because it resides in administrative tool paths, which often possess higher database privileges. The vulnerability is exploitable over the network, and depending on the deployment, it may not require complex authentication bypass, depending on whether the endpoints are exposed to the public internet or are accessible within an internal network segment."
}