CVE-2026-16449: ZS-Admin SQL Injection Vulnerability

CVE-2026-16449 Overview

CVE-2026-16449 is a SQL injection vulnerability in the zsadmin2025 ZS-Admin project, affecting commits up to b52e14536d59fda11e56e2536a1c32e82a38cead. The flaw resides in the OrderItem.asc and OrderItem.desc functions within the com.zs.sys.dept.controller.SysDeptController component, specifically at the /api/system/sys/dept/page endpoint. An authenticated remote attacker can manipulate the orderField parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed. ZS-Admin uses a rolling release strategy, so no fixed version is available, and the project has not responded to the reported issue.

Critical Impact
Authenticated attackers can inject SQL via the orderField parameter to read, modify, or delete backend database records through the department pagination API.

Affected Products

zsadmin2025 ZS-Admin (Java) up to commit b52e14536d59fda11e56e2536a1c32e82a38cead
Component: com.zs.sys.dept.controller.SysDeptController
Endpoint: /api/system/sys/dept/page

Discovery Timeline

2026-07-21 - CVE-2026-16449 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16449

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected endpoint /api/system/sys/dept/page accepts an orderField argument used to construct an ORDER BY clause in the underlying SQL query. The OrderItem.asc and OrderItem.desc helpers in SysDeptController embed this value into the query string without proper sanitization or whitelist validation. An attacker with valid credentials can submit crafted orderField values that break out of the intended sort context and append arbitrary SQL fragments. Because the flaw resides in an administrative pagination API, exploitation can expose department records and any other data reachable through the same database connection.

Root Cause

The root cause is direct concatenation of user-controlled input into a SQL ORDER BY clause. Sort columns are commonly assumed to be safe, so many frameworks skip parameterization for them. In SysDeptController, the orderField value is passed to OrderItem.asc or OrderItem.desc without validation against an allow-list of legitimate column names, allowing injection.

Attack Vector

Exploitation requires a valid low-privileged account and network access to the ZS-Admin backend. The attacker issues a request to /api/system/sys/dept/page with an orderField value containing SQL syntax. The injected SQL executes with the privileges of the application's database user. Detailed technical write-ups are available in the VulDB Vulnerability Details and the GitHub Issue Discussion.

No verified proof-of-concept code is republished here. Refer to the VulDB CVE Record for exploitation specifics.

Detection Methods for CVE-2026-16449

Indicators of Compromise

Requests to /api/system/sys/dept/page containing SQL metacharacters such as single quotes, --, /*, UNION, SELECT, or SLEEP( inside the orderField parameter.
Application or database logs showing malformed ORDER BY clauses or unexpected SQL errors originating from SysDeptController.
Anomalous read volumes or query durations on the department table by the ZS-Admin database user.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the orderField parameter and blocks values outside an allow-list of known column names.
Enable SQL query logging on the backend database and alert on ORDER BY clauses containing subqueries, boolean expressions, or time-based functions.
Correlate authenticated ZS-Admin sessions against injection signatures to identify compromised or malicious accounts.

Monitoring Recommendations

Monitor HTTP access logs for repeated 500 errors on /api/system/sys/dept/page, which often accompany blind SQL injection probing.
Track outbound database traffic for unusual data volumes tied to the ZS-Admin service account.
Alert on time-based payload patterns such as SLEEP, BENCHMARK, or WAITFOR DELAY in application logs.

How to Mitigate CVE-2026-16449

Immediate Actions Required

Restrict network access to the ZS-Admin management interface to trusted administrative networks only.
Rotate credentials for all ZS-Admin accounts and audit account activity for unauthorized use.
Apply a WAF policy blocking SQL metacharacters in the orderField parameter on /api/system/sys/dept/page.
Review database audit logs for evidence of prior exploitation.

Patch Information

No official patch is available. The zsadmin2025 project uses a rolling release model and, according to the VulDB CVE Record, has not responded to the disclosure filed in the GitHub Issue Discussion. Operators must apply source-level fixes locally by validating orderField against a strict allow-list of column names before it reaches OrderItem.asc or OrderItem.desc.

Workarounds

Modify SysDeptController to reject any orderField value not matching a hardcoded list of valid sort columns.
Enforce least-privilege permissions on the ZS-Admin database user, removing DROP, ALTER, and cross-schema access.
Disable or gate the /api/system/sys/dept/page endpoint behind additional authorization until a source patch is applied.

bash

# Example nginx location block restricting orderField values
location = /api/system/sys/dept/page {
    if ($arg_orderField !~ "^(id|dept_name|sort|create_time|update_time)$") {
        return 400;
    }
    proxy_pass http://zsadmin_backend;
}