An SQL injection vulnerability exists in EasyCMS up to version 1.6. The flaw lies in the handling of the _order argument within the file /RbacuserAction.class.php. By manipulating this parameter, an attacker can inject arbitrary SQL code, potentially reading, modifying, or deleting data in the database. The weakness is classified under CWE‑74 and CWE‑89.

The vulnerability affects EasyCMS installations running any version up to and including 1.6. No specific minor releases are listed; affected hosts may be discovering this flaw as part of the component Request Parameter Handler.

The CVSS score of 5.3 indicates moderate risk, but the vulnerability can be exploited remotely and the exploit code is publicly available. EPSS is below 1 %, suggesting rare exploitation so far, and the issue is not currently listed in the CISA KEV catalog. Nevertheless, the presence of a public exploit and the ability to compromise database integrity warrants immediate attention. Attackers would need network access to the web application and supply a crafted _order value to manipulate the query.