Hi.Events versions from 0.8.0-beta.1 up to just before 1.7.1-beta allow attackers to inject raw SQL through the unvalidated sort_by query parameter. The vulnerable code passes the supplied value directly to Eloquent's orderBy() method, and because the application uses PostgreSQL, which supports stacked queries, the injected payload can be executed as additional SQL statements. This flaw can enable attackers to read, modify, or delete data from the database and potentially exfiltrate sensitive information or disrupt operations.

The vulnerability affects the Hi.Events event management platform developed by HiEventsDev. Affected releases include all versions starting with 0.8.0-beta.1 up to, but not including, 1.7.1-beta. Users running any of these builds are potentially exposed.

The flaw carries a CVSS score of 8.7, indicating high severity. While EPSS information is not available, the fact that the exploitation vector is an HTTP query parameter makes the attack unitable from a web context, likely without authentication. The vulnerability is not listed in the KEV catalog, but the high severity and ability to run arbitrary SQL on a PostgreSQL database make it a significant risk to confidentiality, integrity, and availability of affected deployments.