CyberRota Analysis
AI-GeneratedThe vulnerability affects the Subrion CMS, specifically in the admin grid sorting functionality, where improper validation of the `sort` GET parameter allows authenticated administrators to inject arbitrary SQL queries. This can lead to unauthorized access to sensitive database contents, including administrator password hashes. Organizations using Subrion CMS should prioritize patching this issue, particularly those with extensive admin grid functionalities, to mitigate the risk of SQL injection attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.