This vulnerability in jflyfox jfinal_cms up to version 5.1.0 allows remote attackers to perform SQL injection via the orderBy parameter in the list function of AdvicefeedbackController.java. The issue arises from improper handling of this argument, enabling injection of malicious SQL commands. The vulnerability has a CVSS 4.0 score of 5.3, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vendor has been informed but has not yet responded or released a fix.

Successful exploitation could allow an attacker to manipulate SQL queries executed by the application, potentially leading to unauthorized data access or modification. The attack can be launched remotely and does not require user interaction, increasing the risk of exploitation. However, the vulnerability requires low privileges and has limited impact according to the CVSS vector, indicating some constraints on the attacker's capabilities and the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing input validation or filtering on the orderBy parameter as a temporary mitigation. Monitor official channels for updates or patches from the jflyfox project.