An authenticated SQL injection flaw exists in NextGEN Gallery versions prior to 4.2.1. The vulnerability is triggered by manipulating the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. Because the data mapper layer uses a blacklist sanitization for the ORDER BY clause, an attacker who can authenticate with the 'NextGEN Gallery overview' capability—normally assigned to the Administrator role—can inject arbitrary SQL and potentially read, modify, or delete data stored in the underlying database.

The affected product is NextGEN Gallery from awesomemotive. All releases before version 4.2.1 are vulnerable; a user with administrator‑level permissions and the overview capability can exploit the flaw.

The CVSS score of 9.3 indicates a critical impact, and although no EPSS score is available, the requirement for authenticated administrators reduces the breadth of attack vectors but does not eliminate the threat. The flaw is not listed in the CISA KEV catalog. An attacker would need web access to the REST API and sufficient privileges to submit the malicious 'orderby' value. Once exploited, the attacker can gain full data exfiltration or tampering capabilities.