Subrion CMS's _gridGetSorting() function in includes/classes/ia.base.controller.admin.php attempts to whitelist the 'dir' (ASC/DESC) parameter but falls back to using the raw 'sort' GET parameter if the requested key is not found in the per-controller $_gridSorting whitelist array. The 'sort' parameter is then directly inserted into an SQL ORDER BY clause with only backtick quoting and no escaping. Because a backtick in the input breaks out of the identifier context, an authenticated admin can perform error-based or time-based SQL injection (e.g., using EXTRACTVALUE or SLEEP()) to extract database contents, including administrator password hashes. Most of the approximately 29 admin grid controllers either lack a $_gridSorting whitelist or have incomplete whitelists, making the majority of admin grid endpoints exploitable.

An authenticated administrator can exploit this vulnerability to perform SQL injection attacks, potentially extracting sensitive data such as administrator password hashes. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). This could lead to unauthorized data disclosure and manipulation of the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to admin accounts and monitor for suspicious activity. Avoid using untrusted input in SQL queries without proper validation and escaping. Implement a complete whitelist for sortable columns in all admin grid controllers to prevent injection via the 'sort' parameter.