Threats tagged 'ghsa-qj9v-fwc6-5hwr'

Omnispace Agora Project versions through 26.10.0 have a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL via the personsSort session value. This value is used unsanitized in ORDER BY clauses in MdlUser.php and MdlSpace.php. Exploitation can leak database information such as the MariaDB version through error-based payloads on user and space listing pages.