Subrion CMS's admin grid sorting helper (_gridGetSorting in includes/classes/ia.base.controller.admin.php) attempts to whitelist the ASC/DESC sorting parameters using in_array. However, if the requested key is not found in the whitelist, the function uses the raw GET parameter directly, placing it into a SQL query with only backtick quoting and no escaping. This improper handling of input leads to a SQL injection vulnerability (CWE-89) that can be exploited to compromise confidentiality, integrity, and availability of the system. The CVSS 3.1 score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or denial of service affecting the affected Subrion CMS installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been provided at this time. Until a patch is available, restrict access to the admin interface to trusted users only and monitor for suspicious activity.