Grocery crud 1.6.4 - 'order_by' SQL Injection

The SQL injection vulnerability in Grocery Crud allows attackers to inject arbitrary SQL code into database queries. This can be exploited to extract sensitive data, such as user credentials, financial information, or other confidential data stored in the database. An attacker could also modify data, potentially leading to data corruption or denial of service. Successful exploitation could grant an attacker complete control over the database, effectively compromising the entire application. The impact is particularly severe given the potential for unauthorized data access and modification.

Organizations using Grocery Crud in production environments, particularly those handling sensitive data, are at significant risk. Shared hosting environments where multiple users share the same Grocery Crud installation are especially vulnerable, as an attacker could potentially compromise other users' data through this vulnerability.

• php / web:

grep -r 'order_by[]' /var/www/grocery_crud/

• php / web:

find /var/www/grocery_crud/ -name 'ajax_list.php' -print

• generic web:

curl -I 'http://your-grocery-crud-site.com/ajax_list?order_by[]='; # Check for unusual response headers

1. 2026-01-15Disclosure

   disclosure

1. 予約済み2026-01-14
2. 公開日2026-01-15
3. 更新日2026-03-05
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2021-47811 is to immediately upgrade Grocery Crud to version 2.0.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out malicious SQL injection attempts targeting the orderby parameter in the ajaxlist endpoint. Input validation on the order_by parameter is crucial; ensure all input is properly sanitized and validated against a whitelist of allowed values. Monitor application logs for suspicious SQL queries or error messages related to database access.