CVE-2019-10671: SQL Injection in LibreNMS

The CVE-2019-10671 description explicitly calls out graph.php's 'sort' parameter as the exploitation vector for SQL injection. In PHP applications like LibreNMS, SQL injection vulnerabilities typically occur when user input (like $_GET/$_POST parameters) is directly embedded into SQL queries without using prepared statements. The absence of parameterization in the affected code path would manifest in a function handling the 'sort' parameter and constructing ORDER BY clauses. While the exact function name isn't visible in the provided data, the advisory's specificity about graph.php and the sort parameter strongly indicates that the vulnerable code resides in a function responsible for processing sorting logic in this file. The confidence is marked as medium because while the injection vector is clearly identified, the exact function name isn't explicitly provided in the available data.