The vulnerability is triggered when an authenticated administrator supplies a raw sort parameter to the User::orderBy call in the admin user controller. The application passes the parameter directly to the database without validating or sanitizing it, allowing the attacker to sort query results by any column, including sensitive fields such as password hashes and remember tokens. Through ordering analysis, an attacker can infer and disclose restricted information, effectively turning the flaw into a form of SQL injection that leaks confidential data. The flaw is a classic SQL injection vulnerability (CWE-89).

V2Board web application versions up to and including 1.7.4 are affected. The issue resides in the admin/user controller of the application; no specific vendor name is listed. Versions newer than 1.7.4 contain the fix.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated administrator access, limiting the attack surface to privileged accounts. Once the attacker manipulates the sort parameter, they can deduce sensitive data through the ordering of query results, potentially enabling credential compromise or other account‑takeover activities.