Prior to version 2.5.37, the MISP threat‑intel platform accepted unvalidated ordering values from request parameters and concatenated them directly into SQL ORDER BY clauses. The vulnerability enables an attacker with access to the event or shadow attribute listing endpoints to inject arbitrary SQL fragments, potentially leading to data disclosure, modification, or other database‑level consequences. The weakness is classified as CWE‑89, a classic SQL injection flaw that can compromise confidentiality and integrity of the underlying database.

The affected product is MISP version 2.5.36 and earlier. Versions 2.5.37 and later contain the fix. The issue arises only on installations that expose the listing endpoints to authenticated users, which is common in typical MISP deployments.

The CVSS score of 9.3 indicates critical severity. No EPSS value is available, so the exploitation probability is uncertain, but the lack of a KEV listing suggests no publicly known exploits; nevertheless, the generic nature of SQL injection implies a high likelihood of future attacks. The attack can be performed remotely by any user who can reach the listing endpoints and is authorized to use the ordering parameters, indicating a remote vector with user interaction requirements. The maximal impact depends on the database role used by the application; if the application runs with elevated privileges, the damage could be extensive, whereas a lower‑privilege role would limit the scope to the data the user may otherwise access.