FilePress up to version 3.0.1 contains an SQL injection vulnerability that allows low‑privilege authenticated users to inject arbitrary SQL into ORDER BY clauses via the unvalidated asc parameter. By using blind boolean or time‑based subqueries, an attacker can extract database rows, including administrator credential hashes. This is a classic input‑validation flaw catalogued as CWE‑89.

The affected product is FilePress from vendor zyx0814. Versions up to and including 3.0.1 are vulnerable. Earlier unreleased revisions are not documented as affected.

The CVSS score of 7.1 indicates a moderate to high severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation activity is unclear. Inferences from the description imply that exploitation requires authenticated access, but it can be performed by any low‑privilege user who has session credentials. Once the injection is achieved, the attacker can read privileged data such as administrator passwords and potentially achieve further compromise.