AzuraCast versions earlier than 0.23.8 include a DQL injection vulnerability in the sortOrder parameter of AbstractSearchableListAction.php. By sending a crafted sortOrder value, attackers can inject arbitrary DQL expressions that are executed against the application database. The injected queries can retrieve sensitive data such as user credentials and station configuration settings, potentially leaking confidential information.

Affected products are the AzuraCast audio streaming platform. All installations running AzuraCast before version 0.23.8 are vulnerable, as the flaw is in the core API codebase. No specific subversion list was provided, so any deployment predating 0.23.8 should be considered at risk.

The CVSS base score of 8.7 indicates a high severity flaw, and with a lack of an EPSS rating the likelihood of exploitation is uncertain but potentially high. Since the flaw is exploitable via an API endpoint, the attack vector is remote and requires only network access to the sortOrder parameter. The vulnerability is not listed in the CISA KEV catalog, yet it can still be leveraged by skilled adversaries to exfiltrate data. Mitigation relies on applying a patch to 0.23.8 or later, or restricting API access to authenticated users with limited permissions.