Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.