The vulnerability exists in PHPOK 4.5.000 up to versions before 5.4.081 and allows an unauthenticated attacker to perform a SQL injection using the sort parameter of the /api.php endpoint. By inserting specially crafted expressions, the attacker can manipulate the ORDER BY clause and cause database errors that reveal sensitive information, including database contents and potentially credentials or configuration data.

PHPOK, version 4.5.000 and any release prior to 5.4.081. The vulnerable component is the api.php endpoint that processes the sort parameter, exposing systems that run these versions to the risk if the endpoint is publicly accessible.

The CVSS score of 8.8 classifies this as high severity, indicating serious potential impact. The EPSS score is not available, but the vulnerability was first seen in October 2023, showing it is actively exploited by threat actors. The exploit requires no authentication and can be performed over standard HTTP by sending a GET request to /api.php?c=project&f=index with a malicious sort value. Attackers could extract database information via error messages, providing a foothold for further compromise. The vulnerability is not listed in CISA’s KEV catalog at this time.