External risk intelligence

Funiture SQL Injection in Backend Tool Interfaces

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-75336

The vulnerability exists in backend tool interfaces. While these are network-reachable, they are typically intended for administrative or internal use rather than public-facing deployment. Public internet exposure is plausible in some misconfigured or specific deployments, but the CVE context does not clearly establish that these specific interfaces are commonly exposed to the public internet.

SQL Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in a backend component of Funiture, specifically within its tool interfaces. This flaw allows for SQL injection, a common type of cyberattack, which could potentially lead to unauthorized access and manipulation of data. The primary concern at this stage is to confirm if this Funiture component is deployed within our environment and if it is exposed in a manner that could be targeted.

A backend tool flaw allows data attacks.
Confirming relevance is the main leadership concern.
Understand exposure to guide risk assessment efforts.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable backend interfaces of Funiture through the network. Once accessible, they could send specially crafted requests to the `/sys/tool/select.json` or `/sys/tool/update.json` endpoints. This could lead to unauthorized access to or modification of sensitive data.

Network access to backend interfaces.
Sending malicious requests to specific tool endpoints.
Unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Funiture 1.0.0's backend tool interfaces could allow an unauthenticated attacker to manipulate database queries. When these interfaces are exposed to a network, an attacker could potentially access, modify, or delete sensitive data within the application's database.

Database integrity and confidentiality.
Unauthenticated network access.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Funiture's backend interfaces requires immediate attention. Infrastructure or platform teams managing the Funiture deployment are likely responsible for remediation. The first step is to identify all instances of Funiture, determine if these specific backend interfaces are exposed externally or are business-critical, and then engage the accountable owner to plan a risk-based remediation.

Infrastructure or platform teams own.
Verify external reachability and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Funiture software?

Funiture is a software application that includes backend tool interfaces designed to perform administrative or management tasks. Users typically rely on these components to handle internal database operations, such as selecting or updating information through specific system endpoints.

How does CVE-2026-75336 result in a SQL injection?

This vulnerability falls under the CWE-89 weakness class, which involves improper sanitization of user-supplied data. In this case, the Funiture backend interfaces fail to properly validate input, allowing an attacker to inject malicious database commands into queries executed by the application.

What triggers the vulnerability in Funiture?

The flaw is triggered when an attacker sends specially crafted requests to the /sys/tool/select.json or /sys/tool/update.json endpoints. Notably, this vulnerability does not require authentication; however, the bug is only exploitable if the attacker has network connectivity to these specific backend interfaces.

Do I need to worry about internet exposure for this CVE?

Halo Surface Signal notes that while these backend interfaces are network-reachable, they are usually intended for internal or administrative use. While public internet exposure is possible in some misconfigured setups, the risk depends heavily on whether your specific deployment has these interfaces reachable from outside your private network.

How should I respond to CVE-2026-75336?

Start by identifying all instances of Funiture within your environment. Verify whether the vulnerable backend interfaces are accessible over the network and determine their business criticality. Coordinate with the platform team responsible for these systems to assess the risk and establish a plan for remediation.

References

github.com/fangtang7/CVE/blob/main/funiture/SQL%20Injection.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.