Administrator SQL injection via unsanitized sort order

SQL injection in Aaron J 404 Solution before 2.35.8 allows remote authenticated users with administrator access to execute SQL expressions. The administrative logs page incorporates the order parameter into its sorting query without adequate sanitization, escaping, or query preparation; a crafted subquery can trigger a measurable database delay. Exploitation requires an administrator session and a manipulated log-sort request, and the published proof of concept demonstrates time-based query execution rather than a separate operating-system compromise.