CVE-2026-75336: Funiture 1.0.0 SQL Injection Vulnerability

CVE-2026-75336 Overview

CVE-2026-75336 is a SQL Injection vulnerability [CWE-89] in Funiture 1.0.0. The flaw resides in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json. Attackers can inject crafted SQL syntax into request parameters processed by these endpoints. Successful exploitation allows manipulation of the underlying database query logic.

The vulnerability affects backend administrative functionality and can be reached through the exposed JSON endpoints. Public proof-of-concept material is available in a GitHub repository referenced by the advisory.

Critical Impact
Attackers exploiting this SQL Injection can read, modify, or delete database contents, extract credentials, and escalate access to the backend application.

Affected Products

Funiture 1.0.0

Discovery Timeline

2026-08-26 - CVE-2026-75336 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75336

Vulnerability Analysis

The vulnerability exists in two backend tool interfaces exposed by Funiture 1.0.0: /sys/tool/select.json and /sys/tool/update.json. Both endpoints accept user-controlled input that is concatenated into SQL statements without sufficient sanitization or parameterization. An attacker can supply crafted values that break out of the intended query context and inject arbitrary SQL clauses.

Because the flaw affects administrative tool endpoints, exploitation can expose sensitive backend data. Attackers can enumerate database schemas, dump table contents, and modify records through the update.json interface. Depending on database privileges, injection may extend to file read or command execution primitives through database-native functions.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands. User-supplied parameters submitted to /sys/tool/select.json and /sys/tool/update.json reach the database layer without prepared statements or input validation. This allows attacker-controlled SQL syntax to alter query semantics.

Attack Vector

An attacker sends crafted HTTP requests to the vulnerable JSON endpoints with malicious payloads in query or body parameters. The injected SQL executes with the privileges of the application database user. See the GitHub PoC Repository for reproduction details.

Detection Methods for CVE-2026-75336

Indicators of Compromise

HTTP requests to /sys/tool/select.json or /sys/tool/update.json containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or -- comment sequences.
Unexpected database errors or long-running queries originating from the Funiture application user.
Anomalous read or write activity against system tables from the application service account.

Detection Strategies

Deploy web application firewall signatures that flag SQL injection patterns targeting the /sys/tool/ path prefix.
Enable database query logging and alert on statements containing UNION-based extraction or tautology conditions from the application account.
Review application access logs for repeated requests to the two affected endpoints with varying parameter payloads.

Monitoring Recommendations

Correlate web server access logs with database audit logs to identify injection attempts that produce corresponding query anomalies.
Alert on outbound data volume spikes from the database server, which may indicate bulk extraction.
Track failed and successful authentication events on the backend admin interface for suspicious sequences following endpoint access.

How to Mitigate CVE-2026-75336

Immediate Actions Required

Restrict network exposure of the /sys/tool/select.json and /sys/tool/update.json endpoints to trusted administrative networks only.
Deploy a web application firewall rule blocking SQL injection payloads directed at the affected paths.
Audit the database for unauthorized modifications and rotate credentials stored in accessible tables.

Patch Information

No vendor patch information is available in the referenced advisory at the time of publication. Monitor the GitHub PoC Repository and vendor channels for remediation updates.

Workarounds

Place the backend behind an authenticated reverse proxy that enforces strict input validation on JSON parameters.
Reduce database account privileges used by the application to the minimum required for normal operation.
Disable the affected endpoints if they are not required for business operations until a fix is available.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the affected paths
SecRule REQUEST_URI "@rx /sys/tool/(select|update)\.json" \
    "id:1075336,phase:2,deny,status:403,\
    msg:'Potential SQLi against Funiture backend tool endpoint',\
    chain"
  SecRule ARGS "@detectSQLi" "t:none,t:urlDecodeUni"