{"id":"CVE-2026-111669","kind":"vulnerability","aliases":["CVE-2026-111669"],"related":[],"title":"ZR.Admin.NET: SQL injection through sort parameter leaks database contents","description":"ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.","summary":"ZR.Admin.NET through 3.8.2 lets a logged-in user inject SQL into the ORDER BY clause via the PagerInfo.Sort parameter of the shared paging helper. An attacker holding the system:user:list permission can use blind techniques through GET /system/user/list to extract database contents such as stored credentials.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":[".net","asp.net-core","package","self-hosted","zr-admin-net"],"not_affected_if":["no-untrusted-logins","permission-restricted"],"how_to_check":"- Check the installed ZR.Admin.NET version; unknown whether the sources name a specific fixed release.\n- Look for the paging helper ToPage and whether PagerInfo.Sort is passed unvalidated into ORDER BY (unknown from sources).","fix":"- Upgrade ZR.Admin.NET to a release later than `3.8.2` once available (unknown from sources which version is fixed).\n- Until patched, restrict the `system:user:list` permission to trusted roles and rotate stored credentials if exposure is suspected.","status":"open","published_at":"2026-10-16T18:17:49+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:35+00:00","updated_at":"2026-10-25T03:36:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:36:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ZR.Admin.NET to a release later than `3.8.2` once available (unknown from sources which version is fixed).\n- Until patched, restrict the `system:user:list` permission to trusted roles and rotate stored credentials if exposure is suspected.","reach":"network","title":"ZR.Admin.NET: SQL injection through sort parameter leaks database contents","impact":"high","summary":"ZR.Admin.NET through 3.8.2 lets a logged-in user inject SQL into the ORDER BY clause via the PagerInfo.Sort parameter of the shared paging helper. An attacker holding the system:user:list permission can use blind techniques through GET /system/user/list to extract database contents such as stored credentials.","category":"package","nicknames":[],"who_cares":["zr-admin-net",".net","asp.net-core","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker extracts database contents, including stored user credentials, via blind SQL injection","analyst_note":"Confirm fixed version and whether a patch exists; check the NVD entry and the project repository for a fix commit and affected-version range.","how_to_check":"- Check the installed ZR.Admin.NET version; unknown whether the sources name a specific fixed release.\n- Look for the paging helper ToPage and whether PagerInfo.Sort is passed unvalidated into ORDER BY (unknown from sources).","needs_analyst":true,"not_affected_if":["no-untrusted-logins","permission-restricted"],"who_is_affected":"Teams running ZR.Admin.NET version 3.8.2 or earlier with a user account that holds the system:user:list permission are exposed. Installations where only fully trusted administrators can log in, or that do not use this admin panel, have less exposure. The sources do not say whether default configurations differ.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":3370,"output_tokens":673,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111669':12A,15A '-2026':11A,14A '/system/user/list':66B,121C '3.8.2':29B,77C 'admin':25B 'allow':84C 'asp.net':17B 'attack':53B,86C,106C 'authent':85C 'blind':62B,131C 'case':117C 'claus':42B,92C 'contain':78C 'content':9A,70B,125C 'core':18B 'craft':96C 'credenti':74B,129C 'cve':10A,13A 'databas':8A,69B,124C 'express':118C 'extract':68B,123C 'get':65B,120C 'helper':51B,105C 'hold':54B,107C 'host':22B 'inject':3A,36B,81C,114C 'leak':7A 'let':30B 'list':58B,111C 'log':33B 'logged-in':32B 'manipul':88C 'net':16B,26B 'order':40B,90C 'packag':19B 'page':50B,104C 'pagerinfo.sort':45B,97C 'paramet':6A,46B,99C 'permiss':59B,112C 'queri':98C 'self':21B 'self-host':20B 'share':49B,102C 'sort':5A 'sql':2A,37B,80C 'store':73B,128C 'subqueri':115C 'suppli':94C 'system':56B,109C 'techniqu':63B,132C 'topag':103C 'use':61B 'user':35B,57B,110C 'via':43B,119C 'vulner':82C 'zr':24B 'zr-admin-net':23B 'zr.admin.net':1A,27B,75C","nicknames":[],"mitigations":[],"who_affected":"Teams running ZR.Admin.NET version 3.8.2 or earlier with a user account that holds the system:user:list permission are exposed. Installations where only fully trusted administrators can log in, or that do not use this admin panel, have less exposure. The sources do not say whether default configurations differ.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111669","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111669","severity":null,"published_at":"2026-10-16T18:17:49+00:00","modified_at":"2026-10-21T21:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}