GHSA-g7j6-fmwx-7vp8 CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

• Packagist craftcms/cms: >= 5.0.0-RC1, < 5.9.9 → fixed in 5.9.9

The `ElementSearchController::actionSearch()` endpoint is missing the `unset()` protection that was added to ElementIndexesController in GHSA-2453-mppf-46cj. The exact same SQL injection vulnerability (including `criteria[orderBy]`, the original advisory vector) works on this controller because the fix was never applied to it. Any authenticated control panel user (no admin required) can inject arbitrary SQL via `criteria[where]`, `criteria[orderBy]`, or other query properties, and extract the full database contents via boolean-based blind injection. Users should update to the patched 5.9.9 release to mitigate the issue.