Executive brief
GoAdmin is a framework used by developers to quickly build administrative dashboards and data visualization panels. A security flaw in how the framework handles data sorting allows remote attackers to perform unauthorized database operations. This could lead to the theft of sensitive information, such as session identifiers, or allow an attacker to execute malicious code on the server, potentially compromising the entire application and its data.
Technical details
A SQL injection vulnerability exists in GoAdminGroup GoAdmin through version 1.2.26. The flaw is located in the 'getDataFromDatabase' function within 'plugins/admin/modules/table/default.go', where the '__sort_type' and '__sort' URL parameters are directly interpolated into SQL queries using 'fmt.Sprintf' without sufficient sanitization. An unauthenticated remote attacker can exploit this by sending crafted HTTP GET requests to '/admin/info/{table}' endpoints. Successful exploitation can lead to arbitrary SQL command execution, enabling the attacker to extract sensitive database information (such as session cookies) or potentially achieve remote code execution depending on the underlying database configuration.
Affected products
- GoAdminGroup GoAdmin v1.2.26 and earlier
Timeline
- 2026-05-05: other: Vulnerability details published in technical blog post
- 2026-07-01: disclosed: CVE-2026-51946 published