CVE-2026-111669CWE-89sql-injection

CVE-2026-111669

Medium · published October 16, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-16T22:17Z
References (7)
https://gitee.com/izory/ZrAdminNetCore/tags · [email protected]https://github.com/izhaorui/Zr.Admin.NET/blob/v3.8.1/ZR.Admin.WebApi/Controllers/System/SysUserController.cs#L47-L52 · [email protected]https://github.com/izhaorui/Zr.Admin.NET/blob/v3.8.1/ZR.Repository/BaseRepository.cs#L342-L351 · [email protected]https://github.com/izhaorui/Zr.Admin.NET/commit/d32c211aeedab3e07bb4f02f54bb251fff37361c · [email protected]https://hackmd.io/@hieuPenguinnn/zradmin-net-order-by-sort-sql-injection · [email protected]https://www.vulncheck.com/advisories/zr-admin-net-through-3.8.2-sql-injection-via-pagerinfo-sort-order-by · [email protected]https://hackmd.io/@hieuPenguinnn/zradmin-net-order-by-sort-sql-injection · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 16 OCT 17:39Z
    ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY
    cvelistv5
  • 16 OCT 17:39Z
    ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY
    cvelistv5