A flaw in EasyCMS allows attackers to inject arbitrary SQL through the _order argument in the UserAction.class.php file. This leads to unauthorized data extraction or modification via the underlying database. The weakness is classified as CWE-74 and CWE-89, indicating improper SQL command handling and injection vulnerability.

All installations of EasyCMS up to version 1.6 are affected, regardless of deployment environment. The vulnerability resides in the UserAction.class.php file and can be triggered via HTTP requests that pass the _order parameter.

The CVSS score of 6.9 reflects a moderate to high impact. The EPSS score of less than 1% suggests low overall likelihood of widespread exploitation, yet the exploit has been publicly released and can be executed remotely without authentication. The vulnerability is not listed in the CISA KEV catalog, but its public availability means targeted attacks are plausible. Attackers would typically craft an HTTP request containing malicious SQL through the _order parameter to hijack or manipulate data.