Description
A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the argument orderField causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-21
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A remote SQL injection flaw exists in the orderField argument of the /api/system/sys/dept/page endpoint in zsadmin2025 ZS-Admin. By manipulating the orderField value an attacker can inject arbitrary SQL into the ORDER BY clause, potentially exposing or modifying database contents. The weakness is reflected by CWE-74 and CWE-89, with a CVSS score of 5.3 and an EPSS of less than 1%, indicating a moderate severity but low current exploitation probability.

Affected Systems

The vulnerability affects all releases of the zsadmin2025 ZS-Admin application up to commit b52e14536d59fda11e56e2536a1c32e82a38cead. The project follows a rolling release strategy, so exact affected versions cannot be listed. Users should verify if their deployment includes the identified commit or a later fix.

Risk and Exploitability

Although the EPSS score is low and the vulnerability is not listed in CISA's KEV catalog, the attack can be carried out remotely via HTTP requests. Public disclosures have been made and no vendor response has been received, so the risk remains present until a patch or mitigated configuration is applied.

Generated by OpenCVE AI on July 30, 2026 at 17:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy the latest revision of ZS-Admin that fixes the injection flaw if available.
  • Whitelisting or validating the orderField parameter to allow only known column names before it is used in the query.
  • Using prepared statements or ORM techniques that isolate SQL syntax from user-supplied values, especially for ORDER BY clauses.
  • Installing a web application firewall or intrusion prevention system configured to detect and block suspicious ordering injection patterns.
  • Regularly reviewing application logs for anomalous SQL errors or failed queries that may indicate injection attempts.

Generated by OpenCVE AI on July 30, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the argument orderField causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Title zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection
First Time appeared Zsadmin2025
Zsadmin2025 zs-admin
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:zsadmin2025:zs-admin:*:*:*:*:*:*:*:*
Vendors & Products Zsadmin2025
Zsadmin2025 zs-admin
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zsadmin2025 Zs-admin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-22T14:32:56.002Z

Reserved: 2026-07-21T08:55:32.165Z

Link: CVE-2026-16449

cve-icon Vulnrichment

Updated: 2026-07-22T14:32:50.543Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T17:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')