CVE-2019-8979

Kohana through 3.3.6 has SQL Injection when the orderby parameter can be controlled...