This vulnerability in zsadmin2025 ZS-Admin up to commit b52e14536d59fda11e56e2536a1c32e82a38cead allows remote attackers to perform SQL injection via the orderField parameter in the OrderItem.asc/OrderItem.desc functions of the /api/system/sys/dept/page API endpoint. The injection occurs due to improper handling of this argument in the SysDeptController component. The product's rolling release model prevents precise version identification. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). The vendor has not yet provided a remediation or patch, and no known exploits in the wild have been confirmed.

Successful exploitation allows an attacker with low privileges to remotely execute SQL injection attacks, potentially leading to unauthorized data access or manipulation. The impact is rated medium severity with limited scope and complexity, as indicated by the CVSS vector. No confirmed active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restricting access to the vulnerable API endpoint and validating or sanitizing input parameters may reduce risk.