Bolt CMS versions up to and including 3.7.0 contain a flaw in the OrderDirective component that processes the 'order' parameter on content listing pages. The unfiltered parameter permits an authenticated attacker with minimal privileges to inject arbitrary SQL commands. Successful exploitation would allow the attacker to query the database and extract sensitive information, compromising the confidentiality of the application data.

All Bolt CMS installations on or prior to version 3.7.0 are affected. The vulnerability arises wherever the content listing functionality accepts an 'order' field and does not perform proper sanitisation; no specific operating system, database, or configuration is required beyond authentication.

The flaw scores a CVSS score of 6.5. EPSS is not available, so a precise probability estimate is lacking, but the absence of a requirement for privilege escalation means that any authenticated user with low privileges can potentially exploit the injection. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation, yet the potential impact remains significant if attackers acquire any valid authenticated session.