| Package | Affected versions | Patched versions |
|---|---|---|
| v2board | ≤ 1.7.4 |
SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free