Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, whitelists the `dir` (ASC/DESC) request parameter v…

CVE-2026-71292 is a SQL injection vulnerability in Subrion CMS affecting the admin grid sorting helper function _gridGetSorting() in includes/classes/ia.base.controller.admin.php. The vulnerability arises because the function falls back to using the raw, unsanitized 'sort' GET parameter when the requested key is not found in the per-controller $_gridSorting whitelist. This unsanitized value is directly interpolated into an ORDER BY SQL clause with only backtick-quoting, which an attacker can break out of using a backtick in the payload. An authenticated admin can exploit this to perform error-based (EXTRACTVALUE) or time-based (SLEEP) SQL injection to extract sensitive database contents, including administrator password hashes. Approximately 29 admin grid controllers are affected, with most either having no whitelist at all or an incomplete one. Affected controllers include pages.php, transactions.php, languages.php, and members.php among others.