LevelBlue SpiderLabs: SQL Injection in Orkes Conductor: CVE-2025-66387

LevelBlue SpiderLabs disclosed a time-based blind SQL injection vulnerability (CVE-2025-66387) in Orkes Conductor v5.2.4 affecting the /api/workflow/search endpoint: authenticated attackers can inject crafted expressions into the `sort` parameter (e.g., PG_SLEEP-based payloads) to enumerate and exfiltrate PostgreSQL database names and contents; Orkes has remediated the issue and users are advised to upgrade and implement input validation and prepared statements.