CVE-2026-111669: falha de alta gravidade em izhaorui Zr.Admin.NET
ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
probabilidade de exploração
0.3%top 74% das CVEs
exploração observada
nãonenhuma fonte reporta
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
izhaorui · Zr.Admin.NETReferências
https://gitee.com/izory/ZrAdminNetCore/tagshttps://github.com/izhaorui/Zr.Admin.NET/blob/v3.8.1/ZR.Admin.WebApi/Controllers/System/SysUserController.cs#L47-L52https://github.com/izhaorui/Zr.Admin.NET/blob/v3.8.1/ZR.Repository/BaseRepository.cs#L342-L351https://github.com/izhaorui/Zr.Admin.NET/commit/d32c211aeedab3e07bb4f02f54bb251fff37361chttps://hackmd.io/@hieuPenguinnn/zradmin-net-order-by-sort-sql-injectionhttps://www.vulncheck.com/advisories/zr-admin-net-through-3.8.2-sql-injection-via-pagerinfo-sort-order-by