A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

A SQL injection vulnerability has been identified in zyx0814 FilePress up to version 3.0.1. The vulnerability exists in the file dzz/publish/search.php within the Publish Module, where manipulation of the 'orderby' and 'order' arguments allows SQL injection attacks. The attack can be launched remotely without requiring physical access. A public exploit is already available, increasing the risk of active exploitation. The project maintainer was notified via an issue report but has not yet responded or released a patch. This unpatched state combined with public exploit availability makes it a high-priority concern. Organizations using FilePress up to version 3.0.1 are at risk of database compromise and data exfiltration.