CVE-2022-28111: 
Java vulnerability analysis and mitigation

MyBatis PageHelper versions v1.x.x-v3.7.0, v4.0.0-v5.0.0, and v5.1.0-v5.3.0 contain a time-blind SQL injection vulnerability that can be exploited via the orderBy parameter (NVD, CVE). The vulnerability was discovered and disclosed on March 28, 2022.

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-89 (SQL Injection) and allows attackers to perform time-blind SQL injection attacks through the orderBy parameter (NVD).

If successfully exploited, this vulnerability could allow attackers to execute arbitrary SQL commands, potentially leading to unauthorized access to database information, data manipulation, or system compromise (NVD).

The project maintainers recommend that input validation should be handled at the application level through regular expressions or whitelisting. According to the project maintainer's response, the orderBy functionality is intentionally flexible to support complex sorting requirements including functions (GitHub Issues).

The project maintainer has addressed the vulnerability report on GitHub, stating that the orderBy functionality is intentionally permissive to support various use cases. They suggest that security controls should be implemented at the application level rather than within the plugin (GitHub Issues).