ZR.Admin.NET (versions through 3.8.2) contains a SQL injection flaw that occurs when an authenticated user supplies a malicious value for the PagerInfo.Sort query parameter to the ToPage paging helper. The ORDER BY clause is built directly from this parameter without input validation, allowing attackers to inject arbitrary SELECT, sub‑SELECT or CASE statements. The injected payload can be used to read database tables and exfiltrate sensitive information such as stored credentials by exploiting blind techniques. This weakness is classified as CWE‑89 – SQL Injection.

The vulnerability affects the izhaorui Zr.Admin.NET web application, specifically all released versions up to and including 3.8.2. Users who run these versions and have access to the system:user:list permission are impacted.

The CVSS score of 7.1 indicates a high severity potential. EPSS is currently unavailable, and the issue is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation in the wild. However, the attack requires authentication with system:user:list rights and occurs over a GET request. The attacker can craft a Sort parameter in the /system/user/list endpoint, execute subqueries or CASE expressions, and retrieve database contents through blind extraction, yielding significant data exposure.