Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111669ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY

Medium 6.5

In plain English

A medium-severity SQL injection in Zr.Admin.NET from izhaorui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 63.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.

Affected products (as reported)

Vendor	Product	Versions
izhaorui	Zr.Admin.NET	0 – through 3.8.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://hackmd.io/@hieuPenguinnn/zradmin-net-order-by-sort-sql-injection third-party-advisory
https://github.com/izhaorui/Zr.Admin.NET/blob/v3.8.1/ZR.Repository/BaseRepository.cs#L342-L351 technical-description
https://github.com/izhaorui/Zr.Admin.NET/blob/v3.8.1/ZR.Admin.WebApi/Controllers/System/SysUserController.cs#L47-L52 technical-description
https://github.com/izhaorui/Zr.Admin.NET/commit/d32c211aeedab3e07bb4f02f54bb251fff37361c patch
https://gitee.com/izory/ZrAdminNetCore/tags product
VulnCheck Advisory: ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY third-party-advisory