Omnispace Agora Project before 26.10.0 contains a second-order SQL injection flaw where the _idCategoryFilter value is stored in the session and later concatenated into a SQL statement without parameterization. An authenticated user can inject malicious SQL that will run when the filter is applied, enabling the attacker to read, modify, or delete database data and thereby compromising confidentiality and integrity.

All deployments of Omnispace Agora Project versions older than 26.10.0 are affected. The vulnerability resides in app/Common/MdlCategory.php, and any instance where authenticated users can set _idCategoryFilter through the web interface is susceptible, irrespective of the underlying operating system or database.

The CVSS score of 8.6 indicates high severity, whereas the EPSS score of less than 1% reflects a low current exploitation probability. The flaw is not listed in CISA's KEV catalog. Exploitation requires valid credentials and the ability to modify the filter; once triggered, the lack of prepared statements allows arbitrary SQL execution, granting attackers extensive control over the database.