AzuraCast versions prior to 0.23.8 have a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. This flaw allows attackers to inject arbitrary Doctrine Query Language expressions, potentially exposing sensitive database information such as user credentials and station settings.