EUVD-2026-54308
GHSA-r247-mpv9-8ww6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network ORDER BY SQLi is low-complexity; PR:L because admin list endpoints likely require a session; C/I:H for full DB read/write, A:L since availability impact is secondary and RCE is unconfirmed.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints
AnalysisAI
SQL injection in FineAdmin V1.0 (FineAdmin.Mvc) lets remote attackers inject arbitrary SQL through the field and order parameters of paginated list endpoints, where user input is concatenated into an ORDER BY clause that cannot be safely parameterized. NVD rates it CVSS 9.8 with full confidentiality, integrity, and availability impact, and public GitHub write-ups documenting the ORDER BY-clause injection exist, though EPSS remains low at 0.40% (33rd percentile) and it is not in CISA KEV - so no public exploit is confirmed as weaponized. The 'RCE' tag reflects theoretical escalation from SQLi to code execution (e.g. via stacked queries), but the demonstrated impact is database compromise.
Technical ContextAI
FineAdmin.Mvc is an ASP.NET MVC-based administration/scaffolding framework. The flaw is a classic CWE-89 SQL Injection specific to the ORDER BY clause: paginated list/grid endpoints accept field (sort column) and order (sort direction) request parameters and interpolate them directly into the generated SQL statement. Unlike WHERE-clause values, column names and sort direction in an ORDER BY cannot be bound as parameters, so developers frequently build these fragments via string concatenation - exactly the anti-pattern that produces this vulnerability. An attacker who controls the ORDER BY expression can append subqueries, boolean/time-based blind conditions, or (if the driver and DB permit stacked queries) additional statements. No CPE strings were provided; the affected component is identified only by product name and the FineAdmin.Mvc repository referenced in the advisory.
RemediationAI
No vendor-released patch version is identified in the available data, so a specific upgrade target cannot be cited; monitor the FineAdmin project and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-67689) for a fixed release. As the concrete code-level fix, do not concatenate the field and order parameters into SQL: validate field against a strict server-side allowlist of known-good column names and coerce order to a boolean-mapped literal 'ASC' or 'DESC' only - this fully neutralizes ORDER BY injection with no functional loss beyond rejecting unknown sort columns. As interim compensating controls, place the affected list endpoints behind authentication and authorization if they are not already, and deploy a WAF rule to block SQL metacharacters/keywords in the field/order parameters (trade-off: WAF signatures can be bypassed and may false-positive on legitimate column names, so treat as defense-in-depth). Where feasible, run the application's database account with least privilege (read-only, no stacked-query/xp_cmdshell rights) to limit escalation from data disclosure toward code execution.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today