Phishing Club exposes a blind SQL injection vulnerability in the GetOrphaned recipient listing endpoint. The endpoint builds a raw SQL query by concatenating a user‑controlled sortBy value directly into an ORDER BY clause, without validating the input. A user who is authenticated to the application can supply an arbitrary ORDER BY expression and forges SQL that is executed, allowing data extraction from the underlying database. This is a CWE‑89 flaw that can compromise confidentiality of all data accessed by the system.

Phishing Club (phishingclub) versions before 1.30.2 are affected. Any deployment of the open‑source phishing simulation framework with a version earlier than v1.30.2 is vulnerable.

The vulnerability has a CVSS score of 6.5, indicating a significant risk when exploited by an authenticated attacker. EPSS indicates a very low probability of exploitation, but the possibility exists for users with valid credentials. The issue is not listed in CISA’s KEV catalog. An attacker can leverage the flaw to read sensitive data if they can authenticate to the application; the impact is limited to systems where the GetOrphaned recipient listing endpoint is exposed and users have authentication.