Subrion CMS’s admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, enforces a whitelist for the (ASC/DESC) request parameter using in_array. However, if the requested sort key is not present in a per‑controller whitelist array, the logic falls back to the raw attacker‑supplied GET parameter, inserting it into an ORDER BY clause with only backtick quoting and no escaping. This flaw allows an authenticated administrator to inject malicious SQL via the sort key, enabling extraction of sensitive database data and compromising confidentiality.

The vulnerability affects Subrion CMS, specifically its admin grid endpoints defined in includes/classes/ia.base.controller.admin.php. With almost all of the CMS’s ~29 admin grid controllers missing or having incomplete whitelists, any installation that supplies an authenticated admin user can exploit the flaw. No specific product version range is provided, so the risk applies to all current releases that have not been patched for this issue.

The CVSS score of 7.2 indicates a high severity; EPSS data is < 1%, and the vulnerability is not listed in the CISA KEV catalog, but the reliance on an authenticated admin user limits the attack surface. Once the vulnerability is leveraged, an attacker can extract privileged data, including password hashes, and potentially elevate privileges. The lack of public exploitation evidence suggests the risk is moderate to high, but the potential impact warrants immediate attention.