A critical authorization bypass in Funadmin allows unauthenticated attackers to remotely modify system configurations, posing a significant risk to environment integrity.

The vulnerability exists within the setConfig function located in the app/backend/controller/Ajax.php file, which fails to perform necessary authentication or capability checks before processing configuration updates. This allows any unauthenticated remote attacker to execute unauthorized changes to the system via the Ajax controller.

Successful exploitation allows an unauthenticated actor to alter application-level settings, which could lead to unauthorized data access, service disruption, or further system compromise. With a CVSS score of 7.3, this flaw represents a high risk to business operations, as it effectively removes the primary authentication gate for administrative configuration tasks.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the administrative Ajax controller endpoints via firewall rules or web server configurations.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at app/backend/controller/Ajax.php or similar Ajax-handling scripts, particularly those originating from untrusted IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized access to the application backend and filter suspicious payloads attempting to invoke the setConfig function.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the security research write-up hosted on GitHub.

Given the lack of a vendor-provided patch and the availability of a public proof-of-concept, users of the affected Funadmin versions must prioritize the implementation of network-level access controls. Administrators should treat this as a high-priority risk and seek to isolate the vulnerable controller from public exposure until an official security update is released.