CVE-2019-8979

CVE-2019-8979

Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.

Source: CVE-2019-8979