funadmin Improper Authorization Vulnerability in Configuration Handler

A vulnerability allowing unauthorized access to configuration modification has been identified in funadmin versions through 7.1.0-rc4. The issue resides in the setConfig function within app/backend/controller/Ajax.php, where inadequate authentication and authorization checks permit remote attackers to alter system configuration without logging in.

Impact

Exploitation of this vulnerability allows for arbitrary changes to system configuration settings, which could lead to further security risks or system mismanagement.

Reproduction

The vulnerability can be reproduced by sending a request to the setConfig function in app/backend/controller/Ajax.php without authentication. This can be done by crafting a request that bypasses the missing authorization checks, allowing unauthorized users to access and modify configuration settings.