The vulnerability exists in REDAXO’s list rendering code, where the sort column parameter is accepted without validation against registered sortable columns. This flaw allows an authenticated backend user to inject an ORDER BY clause that references any table column. By causing an error response, the attacker can enumerate the names and positions of columns in joined tables, including sensitive fields such as hashed passwords. The effect is that an authenticated user can learn internal database structure and potentially expose confidential data. The flaw is classified as improper input validation (CWE‑20) and information exposure (CWE‑200).

Redaxo Core is affected. All releases prior to 5.21.2 are vulnerable. The issue was addressed in 5.21.2 and later versions.

The CVSS base score of 4.3 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Exploitation requires an authenticated backend session; an attacker with valid credentials could use the vulnerable list interface to construct forged ORDER BY statements. Successful exploitation can reveal column names and sensitive data through error messages, but does not provide remote code execution or privilege escalation. The risk is therefore limited to authenticated users who own backend accounts.