Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter

An authenticated attacker with at least Editor-level privileges accesses the admin pages that invoke the `import_list()`, `url_detail()`, or `file_detail()` callbacks while the ImportData module is enabled. The plugin fails to sanitize or validate the `orderby` and `order` parameters before embedding them into SQL queries, allowing the attacker to inject malicious SQL fragments. By observing time delays in the response, the attacker can perform time-based blind SQL injection to extract sensitive data from the database. [ref_id=1]

The advisory states that the fix is included in version 2.15.20 of the Infility Global plugin. Although the patch diff is not provided in the bundle, the remediation must involve proper sanitization or validation of the `orderby` and `order` parameters before they are used in SQL queries, likely by whitelisting allowed column names and sort directions or by using prepared statements. This prevents attackers from injecting arbitrary SQL fragments through these parameters. [ref_id=1]