An SQL injection vulnerability exists in the QueryGenerator.doMultiFieldsOrder method of mahonelau kykms. The method accepts a column argument that is directly concatenated into an ORDER BY clause without sanitization. This flaw permits an attacker to inject arbitrary SQL into the query, potentially leading to unauthorized data extraction, modification, or other database manipulation. The impact includes loss of confidentiality, integrity, and the possibility of remote compromise of the system’s data.

The vulnerability affects mahonelau kykms releases that include code up to the commit hash 8f130c2d85842d5b44caae78cc46d65e505949f7. Because the product follows a rolling release model, precise version numbers are not provided. Any instance running the vulnerable code prior to that commit is at risk.

The CVSS score of 6.9 classifies the flaw as moderate, and its EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, indicating limited publicly known exploitation. However, the exploit is publicly available and remote exploitation is possible, most likely via any exposed API or web interface that calls the vulnerable method. Attackers could supply a crafted column value containing SQL injection payloads, potentially gaining unauthorized data access or manipulating database contents.