EUVD-2026-102960
GHSA-vcvg-6jh6-f58f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with system:user:list permission
-
ExploitSend GET /system/user/list with crafted PagerInfo.Sort
-
ExecutionInject subquery/CASE into ORDER BY clause
-
ImpactBlind-extract stored credentials from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session whose account holds the system:user:list permission; the attacker then supplies a crafted PagerInfo.Sort query parameter to GET /system/user/list, which flows unsanitized into the ORDER BY clause of the shared ToPage paging helper in ZR.Repository/BaseRepository.cs. Affects ZR.Admin.NET up to and including 3.8.2. Limiting factors: exploitation is read-only (blind extraction only, no write/RCE), requires valid credentials plus the specific list permission (not unauthenticated), and is blocked on 3.8.1+/patched builds where parm.Sort is passed through ToSqlFilter(). |
| Impact | Signals are moderate and largely consistent. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) yields 7.1 (High): network-reachable, low attack complexity, no user interaction, with high confidentiality impact but no integrity or availability impact - consistent with a blind SQL injection used only to read data. The key mitigating signal is PR:L: exploitation requires an authenticated account that specifically holds the system:user:list permission, so this is not an unauthenticated internet-facing flaw. No EPSS score and no KEV status were provided in the input, and there is no explicit POC=YES marker, so there is no evidence of active exploitation; however a detailed public technical writeup (hackmd) and the vendor patch commit both exist, lowering the barrier to weaponization. On balance this is a real, patch-worthy issue (credential theft from the SysUser table is possible) but not an emergency: the authentication-plus-permission precondition and the niche deployment footprint make widespread opportunistic exploitation unlikely. No conflicting signals were detected between the CVSS vector and the description - both agree on authenticated, network-based, confidentiality-only impact. |
| Exploit ScenarioDerived | An attacker who already holds a valid account with the system:user:list permission sends GET /system/user/list with a crafted PagerInfo.Sort value that injects a subquery or CASE expression into the ORDER BY clause built by the shared ToPage helper. By observing ordering differences across requests (blind inference), the attacker extracts sensitive database contents such as stored user credentials. A public technical writeup documenting the technique exists, though no packaged exploit tool is confirmed in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Authenticated SQL injection in ZR.Admin.NET through 3.8.2 allows any account holding the system:user:list permission to inject subquery or CASE expressions into the ORDER BY clause of the shared ToPage paging helper by supplying a crafted PagerInfo.Sort query parameter to GET /system/user/list, enabling blind extraction of database contents such as stored credentials. The flaw is read-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor-published CVSS 4.0 base of 7.1) and requires a valid low-privileged session with that specific list permission, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis, though a public technical writeup describing the ORDER BY injection path exists; a vendor patch is available.
RemediationAI
Vendor-released patch available: apply commit d32c211aeedab3e07bb4f02f54bb251fff37361c (or upgrade to the ZR.Admin.NET release built after 3.8.2, which carries it), whose change wraps parm.Sort with SqlSugar's ToSqlFilter() in both ToPage<T> and ToPage<T,T2> in ZR.Repository/BaseRepository.cs so injected subquery/CASE tokens are stripped before reaching the ORDER BY clause; verify the deployed BaseRepository.cs contains .ToSqlFilter() at both call sites, since simply upgrading without confirming the source is present is insufficient. Until the patch is deployed, the most effective compensating control is permission hygiene: remove the system:user:list claim from all but strictly trusted administrative roles, which closes the vulnerability for unprivileged accounts at the cost of narrowing normal user-management visibility. Additionally, enforce server-side whitelisting of allowed sort column names (and asc/desc values) before they reach the paging helper, or reject requests whose PagerInfo.Sort contains spaces, parentheses, commas, or keywords such as CASE/WHEN/SELECT - the trade-off is that legitimate sorting must be constrained to a fixed column list. A reverse-proxy or WAF rule that inspects the Sort parameter on GET /system/user/list and blocks ORDER BY-style payloads provides defense in depth with the caveat that blind, low-and-slow extraction can evade signature-based rules, so it should not replace the patch. Audit database/user-manager logs for anomalous ordering requests against /system/user/list, and rotate database credentials that may have been exposed, given the vulnerability's blind read of stored credentials. References: vendor patch commit (https://github.com/izhaorui/Zr.Admin.NET/commit/d32c211aeedab3e07bb4f02f54bb251fff37361c), VulnCheck advisory (https://www.vulncheck.com/advisories/zr-admin-net-through-3.8.2-sql-injection-via-pagerinfo-sort-order-by), and technical writeup (https://hackmd.io/@hieuPenguinnn/zradmin-net-order-by-sort-sql-injection).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ZR.Admin.NET is a .NET-based admin/backend framework built on the SqlSugar ORM, and the vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) instance applied to an ORDER BY clause rather than a WHERE predicate. In ZR.Repository/BaseRepository.cs the shared paging helpers ToPage<T> and ToPage<T,T2> build the sort expression by string interpolation - source.OrderByIF(parm.Sort.IsNotEmpty(), $"{parm.Sort} {(parm.SortType.Contains("desc") ? "desc" : "asc")}") - meaning the raw PagerInfo.Sort value taken from the HTTP query string is concatenated directly into the ORDER BY fragment. Because ORDER BY cannot be parameterized in most ORMs, the value crosses into SQL text, and since SqlSugar permits subselects and CASE expressions in ORDER BY, an attacker can encode boolean predicates and exfiltrate data row-by-row through ordering differences (blind extraction). The permission gate is that GET /system/user/list is reached through SysUserController (ZR.Admin.WebApi/Controllers/System/SysUserController.cs) and requires the system:user:list authorization claim, which the attacker must already hold. The published fix commit d32c211aeedab3e07bb4f02f54bb251fff37361c wraps parm.Sort with SqlSugar's ToSqlFilter() sanitizer before interpolation, neutralizing the injected tokens on 3.8.1+/patched builds. The affected CPE cpe:2.3:a:izhaorui:zr.admin.net:*:*:*:*:*:*:*:* carries a wildcard version, so version scoping must come from the advisory text (through 3.8.2) and the repository tags rather than the CPE.
Know when Zr Admin Net gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity, but requires an authenticated account holding system:user:list so PR:L; blind read-only data extraction gives C:H with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.
Executive ViewAI
ZR.Admin.NET deployments up to version 3.8.2 contain a SQL injection flaw in the shared paging helper that lets any authenticated user holding the system:user:list permission read arbitrary database contents, including stored credentials, through the standard user list endpoint. Because the permission is commonly granted to routine administrative and support roles, the weakness likely affects a broad set of internal accounts rather than a small privileged group, and credential theft could enable lateral movement into other connected systems. Exploitation requires a valid low-privileged session, so external risk is limited, but the confidentiality exposure to insiders and compromised accounts is significant.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB