CVE-2026-111669: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in izhaorui Zr.Admin.NET

CVE-2026-111669 describes an SQL injection vulnerability in Zr.Admin.NET through version 3.8.2. Authenticated attackers with the system:user:list permission can supply a crafted PagerInfo.Sort query parameter to the ToPage paging helper, enabling manipulation of the ORDER BY clause. This allows injection of subqueries or CASE expressions via the GET /system/user/list endpoint, potentially exposing sensitive data such as stored credentials through blind SQL injection methods.

An attacker with valid authentication and the system:user:list permission can exploit this vulnerability to extract sensitive database information, including stored credentials, without direct visibility of query results (blind SQL injection). This compromises data confidentiality and may lead to further system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with the system:user:list permission and monitor for suspicious activity related to the PagerInfo.Sort parameter.