Yiuman citrus versions up to 0.15.0 expose an ORDER BY SQL injection vulnerability in the citrus-support generic query framework. Attackers can inject malicious SQL through the sortBy request parameter, allowing them to append arbitrary ORDER BY clauses to queries. This flaw enables data extraction via boolean- or time-based blind techniques, potentially leaking sensitive database contents.

The vulnerability affects Yiuman citrus 0.15.0, specifically the citrus-support module used by controllers that extend BaseQueryController or BaseQueryRestful. No other versions or products are listed, and the impact is limited to systems deploy this version of the framework.

The CVSS score of 7.1 indicates a high severity risk. EPSS Score is < 1%, indicating a very low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. Exploitation requires only that an attacker can send HTTP requests to generic list routes, making it a remote attack that does not depend on elevated privileges. Once triggered, an attacker can extract database values by observing response timing or boolean outcomes.