REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd Patch
- https://github.com/redaxo/core/pull/6580 Issue Tracking, Patch
- https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58 Exploit, Vendor Advisory
- https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · redaxoNVD modified 2026-10-19 19:37
Affected (CPE criteria) 1
cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*
References 5
- https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd Patch
- https://github.com/redaxo/core/pull/6580 Issue Tracking, Patch
- https://github.com/redaxo/core/releases/tag/5.21.2 Release Notes
- https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58 Exploit, Vendor Advisory
- https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58 Exploit, Vendor Advisory