Grocery Crud SQL Injection Vulnerability in Order_By Parameter

A SQL injection vulnerability has been identified in Grocery Crud version 1.6.4. The issue resides in the order_by parameter, which can be exploited by remote attackers to manipulate database queries. By injecting malicious SQL code through the order_by[] parameter in POST requests to the ajax_list endpoint, attackers may be able to extract or modify database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a POST request to the ajax_list endpoint. Include the order_by[] parameter in the request body and inject malicious SQL code. The application will process the SQL injection, allowing access to or manipulation of the database.