Authenticated (user role) SQL injection in OrderAndPaginate (GHSL-2023-270)

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.0 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS

• CVE-2024-22196: 0.58% estimated exploitation activity in the next 30 days; percentile 47.98 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary The OrderAndPaginate function is used to order and paginate data. It is defined as follows: By using DefaultQuery, the "desc" and "id" values are used as default values if the query parameters are not set. Thus, the order and sortby query parameter are user-controlled and are being appended to the order variable without any sanitization. The same happens with SortOrder, but it doesn't seem to be used anywhere. This issue was found using CodeQL for Go: Database query built from user-controlled sources. Proof of Concept Based on this setup using uozi/nginx-ui:v2.0.0-beta.7. In order to exploit this issue, we need to find a place where the OrderAndPaginate function is used. We can find it in the GET /api/dnscredentials endpoint. The PagingList function is defined as follows: And the PagingListData function is defined as follows: Using the following request, an attacker can retrieve arbitrary values by checking the order used by the query. That is, the result of the comparison…

Published by the source

11 Jan 2024, 16:27 UTC

Last modified by the source

6 Jul 2026, 19:14 UTC

Source last checked

26 Oct 2026, 15:24 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-h374-mm57-879c

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-22196

Advisory: Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)
IDs: CVE-2024-22196, GHSA-h374-mm57-879c
Record: https://patchnext.com/advisories/cve-2024-22196 (revision 1, source checked 26 Oct 2026, 15:24 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.0)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/0xJacky/Nginx-UI 1.9.10-0.20231219195202-ec93ab05a3ec. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/0xJacky/Nginx-UI: affected < 1.9.10-0.20231219195202-ec93ab05a3ec; fixed in 1.9.10-0.20231219195202-ec93ab05a3ec

## Suggested inspection (read-only)
- Go github.com/0xJacky/Nginx-UI: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/0xJacky/Nginx-UI.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-h374-mm57-879c (GitHub-reviewed advisory GHSA-h374-mm57-879c lists affected ranges: Go github.com/0xJacky/Nginx-UI >=0 <1.9.10-0.20231219195202-ec93ab05a3ec)

Commands are suggestions: review each one before running it.