CVE-2026-16449 in ZS-Admin
Summary
by MITRE • 07/21/2026
A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the argument orderField causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability identified in zsadmin2025 ZS-Admin represents a critical sql injection flaw within the system's department management component. This weakness exists in the OrderItem.asc and OrderItem.desc functions of the SysDeptController class, specifically within the /api/system/sys/dept/page endpoint. The vulnerability stems from insufficient input validation and sanitization of the orderField parameter, which allows malicious actors to manipulate database queries through crafted input values. The issue manifests as a direct manipulation of sql query construction logic where user-supplied ordering parameters are directly concatenated into sql statements without proper escaping or parameterization techniques.
The technical exploitation of this vulnerability occurs through remote code execution capabilities, enabling attackers to inject malicious sql payloads that can bypass authentication mechanisms and access sensitive data. This flaw falls under the CWE-89 category of sql injection, which is classified as a high-risk vulnerability in the Common Weakness Enumeration catalog due to its potential for data breach and system compromise. The ATT&CK framework categorizes this as a database access technique where adversaries leverage sql injection to extract confidential information, modify database contents, or escalate privileges within the system. The rolling release strategy employed by this project creates additional challenges for remediation since version identification becomes problematic, making it difficult to determine specific vulnerable releases or patches.
The operational impact of this vulnerability extends beyond simple data exposure, as it can enable full system compromise and unauthorized access to departmental information. Attackers could potentially extract user credentials, departmental data structures, and other sensitive organizational information through carefully crafted sql injection payloads. The fact that exploitation has been publicly disclosed increases the risk profile significantly, as threat actors can readily implement known attack vectors against affected systems. Organizations utilizing this software are particularly vulnerable due to the lack of specific version information for affected releases, making it challenging to assess risk levels and implement appropriate mitigation strategies. The delayed response from the project maintainers following early issue reporting creates a window of opportunity for malicious actors to exploit this vulnerability before proper patches can be deployed.
Mitigation strategies should include immediate implementation of input validation controls and parameterized queries for all sql operations within the affected component. Organizations should consider implementing web application firewalls to detect and block suspicious sql injection patterns targeting the specific endpoint. The recommended approach involves sanitizing all user inputs, particularly those used in dynamic query construction, and implementing proper error handling that does not expose database structure information. Additionally, organizations should conduct comprehensive penetration testing to identify similar vulnerabilities within other components of the system that may be susceptible to similar exploitation techniques. Regular security audits and vulnerability assessments should be performed to ensure that sql injection prevention mechanisms remain effective against evolving attack vectors and that proper patch management procedures are implemented to address known vulnerabilities in third-party software components.