A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. (CVE-2026-16449)

The vulnerability in zsadmin2025 ZS-Admin up to commit b52e14536d59fda11e56e2536a1c32e82a38cead is a SQL injection flaw located in the OrderItem.asc/OrderItem.desc function of the /api/system/sys/dept/page API endpoint, specifically in the com.zs.sys.dept.controller.SysDeptController component. The issue arises from improper handling of the orderField argument, which can be manipulated remotely to inject SQL commands. The vulnerability has been publicly disclosed, and exploit code may be available. The project has been notified but has not issued a fix or response. Because the software uses a rolling release model, precise affected versions cannot be enumerated.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database via the orderField parameter. This could lead to unauthorized data access, modification, or other database impacts depending on the database privileges. However, the CVSS vector indicates low severity, suggesting limited impact or exploitability factors. No known exploits in the wild have been reported.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the vulnerable API endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the orderField parameter. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.