FineAdmin.Mvc: SQL injection via sort parameter in Button list
Summary
FineAdmin.Mvc v1.0 contains a SQL injection flaw in the field (sort column) parameter of the /Permissions/Button/List endpoint, reached through ButtonService.GetListByFilter(). The value is concatenated into the ORDER BY clause without validation. According to the vulnerability report, an attacker can use crafted SQL to read sensitive database information, and the authorization filter reportedly does not block anonymous requests. A public proof of concept exists.
Affected
- FineAdmin.Mvc v1.0 (sources conflict on the exact range; some state 1.0 and earlier, others 1.0 and later)
- Endpoint: GET /Permissions/Button/List (shared base service may affect other list endpoints)
- Vendor and product details unverified
Fixed in
Unknown.
Workaround
- No vendor mitigation found.
- Restrict sort columns and sort direction to a server-side allowlist, or use a fixed default sort.
- Restrict access to the admin area (network allowlist, VPN or access proxy) until a fix is confirmed.
Exploitation
- Public proof of concept available.
- SSVC: exploitation PoC, automatable yes, technical impact total.
- No evidence of active exploitation found; not listed in KEV.
- Authentication requirement is disputed: the CVE data indicates none (PR:N), while a related CVE may require low privileges.
Our recommendation
- Check whether FineAdmin.Mvc is used in any internal or customer application.
- If it is used, restrict access to the admin panel and avoid internet exposure.
- Apply the allowlist or parameterised fix to the sort parameter, or obtain a patched release from the maintainer.
- Change any default administrator credentials and review the database account's privileges.
- Monitor web and database logs for unusual sort parameters or SQL errors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE reference (GitHub proof of concept) github.com
- Strix CVE-2026-88424 www.strix.ai
- PT-2026-106090 (Vulners) vulners.com
- CVEBrief archive cvebrief.com
- Related ORDER BY SQL injection write-up github.com
- Related CVE-2026-67689 PoC github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:14.
Original description (NVD)
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.