{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/plugin-collection-sql--2.2.28/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nocobase:plugin-collection-sql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-112306"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["plugin-collection-sql (\u003c= 2.2.28)"],"_cs_severities":["high"],"_cs_tags":["sql-injection","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":["NocoBase"],"content_html":"\u003cp\u003eNocoBase plugin-collection-sql through version 2.2.28 contains a critical SQL injection vulnerability identified as CVE-2026-112306. The issue resides in the sqlCollection:setFields action, where the application fails to properly validate user-supplied input before executing it against the database. An authenticated user with sufficient privileges can bypass the checkSQL() validation function to store malicious SQL payloads within the collection configuration. When the collection is subsequently reloaded by the application, the injected statements are executed with the database service account permissions. This allows an attacker to interact with the PostgreSQL backend, enabling unauthorized access to sensitive data, such as pg_shadow password hashes, or the ability to invoke functions like pg_read_file to exfiltrate arbitrary files from the server filesystem. This vulnerability poses a high risk to data confidentiality and integrity.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to perform unauthorized database operations, including data extraction, credential theft, and potentially remote file reading from the server hosting the PostgreSQL database. This compromises the entire data layer and could lead to full system compromise depending on the database service account privileges and server configuration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade NocoBase plugin-collection-sql to a patched version beyond 2.2.28 immediately.\u003c/li\u003e\n\u003cli\u003eReview all database collection configurations in NocoBase for unauthorized or unexpected modifications to field definitions.\u003c/li\u003e\n\u003cli\u003eRestrict administrative or privileged access to the NocoBase instance to only trusted users to mitigate the risk of malicious exploitation of this feature.\u003c/li\u003e\n\u003cli\u003eImplement strict database permission controls, ensuring the PostgreSQL service account operates with the principle of least privilege, specifically restricting access to system tables and sensitive filesystem functions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T18:10:01Z","date_published":"2026-10-19T18:10:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nocobase-sql-injection/","summary":"An SQL injection vulnerability in NocoBase plugin-collection-sql allows authenticated privileged users to bypass validation and execute arbitrary SQL commands on the underlying PostgreSQL database.","title":"SQL Injection Vulnerability in NocoBase plugin-collection-sql","url":"https://feed.craftedsignal.io/briefs/2026-10-nocobase-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Plugin-Collection-Sql (\u003c= 2.2.28)","version":"https://jsonfeed.org/version/1.1"}