REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
Medium · CVSS 4.3
### Summary The `rex_list` component reads the SQL sort column directly from the `sort` GET parameter without validating it against the set of columns declared sortable via `setColumnSortable()`. Although the value is wrapped in backticks via `escapeIdentifier()` (preventing classical SQL injection), this still allows any authenticated backend user to ORDER BY any column in the query's FROM tables, including unselected sensitive columns such as `password` from the `rex_user` table, and perform error-based column enumeration.
Remediation
Upgrade redaxo/source to 5.21.2 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-4f5f-j737-pm58