CVE-2026-111411

Summary

Blind SQL injection in Aman FunnelKit Automations (plugin version ≤3.8.5.2) allows unauthenticated attackers to infer database contents by observing timing or response differences, due to improper sanitization of user input in SQL queries.

Exploitability

Exploitation is feasible remotely without authentication or user interaction, but requires time-based or error-based techniques to extract data, making it slower and less reliable than classic SQL injection.

Blast radius

Successful exploitation could lead to full compromise of backend database confidentiality (e.g., user credentials, personal data) and potential disruption via denial-of-service through resource-intensive queries.

Detection

Defenders should monitor web server access logs for unusually long HTTP response times (e.g., >10 seconds) paired with repeated requests containing SQL-like patterns (e.g., 'AND 1=1', 'SLEEP(', 'BENCHMARK(') in query parameters or POST bodies, especially from non-logged-in users.

Prioritized remediation

Upgrade to FunnelKit Automations version 3.8.5.3 or later, which contains the vendor-provided fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.