SQL Injection Vulnerability in ZR.Admin.NET Product by Izhaorui

CVE-2026-111669

What is CVE-2026-111669?

ZR.Admin.NET versions up to 3.8.2 are susceptible to an SQL injection vulnerability. Authenticated attackers with system:user:list permission can exploit this weakness by manipulating the ORDER BY clause through a specially crafted PagerInfo.Sort query parameter in the shared ToPage paging helper. By accessing the endpoint GET /system/user/list, attackers can leverage blind techniques to extract sensitive database information, including stored credentials. This flaw highlights the necessity of stringent input validation and secure coding practices to mitigate potential exploitation.

References