Focalboard Second-Order SQL Injection Vulnerability in Category Reordering API

A second-order SQL injection vulnerability has been identified in Focalboard version 8.0. The issue arises because the application fails to properly sanitize category IDs before using them in dynamic SQL statements during the category reordering process. This flaw allows authenticated attackers to inject malicious SQL payloads into the category ID field, which is then executed unsanitized when the category reorder API processes the stored value. Exploiting this vulnerability could lead to the exfiltration of sensitive data, including the password hashes of other users.

Impact

Exploitation of this vulnerability allows authenticated attackers to perform time-based blind SQL injection, exfiltrating sensitive data such as other users' password hashes.