InvoicePlane SQL Injection Vulnerability Allowing Data Extraction

A SQL injection vulnerability has been identified in InvoicePlane versions through 1.6.3. The issue arises in the reporting functionality, specifically within the 'maxQuantity' and 'minQuantity' parameters. An authenticated attacker can exploit this vulnerability through error-based SQL injection, allowing for the extraction of arbitrary data from the database. The root cause of the vulnerability is insufficient sanitization of single quotes in the SQL query construction.

Impact

Exploitation of this vulnerability allows for error-based SQL injection, enabling authenticated attackers to manipulate SQL queries and extract sensitive data from the database.

Reproduction

To reproduce this vulnerability, an authenticated user can send a request to the reporting feature with crafted 'maxQuantity' and 'minQuantity' parameters. The injected SQL payloads can exploit the application's SQL query handling, leading to data extraction via the application's error messages.

Remediation

Users can upgrade to InvoicePlane version 1.6.4 to address this vulnerability.