CyberRota Analysis
AI-GeneratedWorklenz versions up to 3.0.0 are vulnerable due to inadequate validation of the sort-field query parameter, enabling authenticated users to perform SQL injection attacks through ORDER BY clauses. This flaw allows attackers to potentially extract sensitive data, such as password hashes, from other tenants' databases. Organizations using affected versions should prioritize remediation to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.