This vulnerability is a classic SQL injection flaw in the GoAdminGroup GoAdmin web application. The flaw is triggered by the __sort_type parameter on all /admin/info/{table} endpoints. When a remote attacker supplies a malicious value in that parameter, the application directly incorporates it into a database query, enabling the execution of arbitrary SQL statements that can be used to extract sensitive data or achieve code execution depending on the database privileges. The consequence is potential full compromise of the underlying data store and, in worst case, the hosting server if the GoAdmin process runs with higher privileges.

GoAdminGroup GoAdmin version 1.2.26 is impacted. Any instance where the web administration interface is exposed to untrusted networks (public internet or internal networks without proper segmentation) is at risk. The vulnerability applies to the /admin/info/{table} endpoints across all supported tables.

The CVSS score of 6.5 categorizes this issue as moderate severity, while the EPSS score of less than 1% indicates a very low but non-zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. A remote attacker can send a crafted HTTP request to a /admin/info/{table} endpoint containing an injected __sort_type value. Based on the description, it is inferred that the attacker can execute arbitrary SQL statements, which may allow extraction of sensitive data or leverage the database user's privileges. The description mentions "arbitrary code execution", but it is unclear whether this translates to host‑level code execution; the impact appears limited to database‑level operations.