CVE-2026-88397
UnknownSummary
ApiAdmin v5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
Risk Assessment
The risk includes the possibility of remote execution of unauthorized database queries, which could lead to data leakage or modification. The attack can be performed without authentication.
Recommendation
It is recommended to immediately upgrade ApiAdmin to the latest version and use prepared statements for the gid parameter. Also restrict access to the endpoint.
Other vulnerabilities in ApiAdmin
See all- CVE-2026-88396Unknown
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim with no whitelist, blacklist or content check, and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.
- CVE-2026-71622High
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component.
- CVE-2026-71620High
File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file.
Original NVD description (English source)
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS