Plugin-Collection-Sql (<= 2.2.28) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/plugin-collection-sql--2.2.28/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 18:10:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection Vulnerability in NocoBase plugin-collection-sqlhttps://feed.craftedsignal.io/briefs/2026-10-nocobase-sql-injection/Mon, 19 Oct 2026 18:10:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-nocobase-sql-injection/An SQL injection vulnerability in NocoBase plugin-collection-sql allows authenticated privileged users to bypass validation and execute arbitrary SQL commands on the underlying PostgreSQL database.NocoBase plugin-collection-sql through version 2.2.28 contains a critical SQL injection vulnerability identified as CVE-2026-112306. The issue resides in the sqlCollection:setFields action, where the application fails to properly validate user-supplied input before executing it against the database. An authenticated user with sufficient privileges can bypass the checkSQL() validation function to store malicious SQL payloads within the collection configuration. When the collection is subsequently reloaded by the application, the injected statements are executed with the database service account permissions. This allows an attacker to interact with the PostgreSQL backend, enabling unauthorized access to sensitive data, such as pg_shadow password hashes, or the ability to invoke functions like pg_read_file to exfiltrate arbitrary files from the server filesystem. This vulnerability poses a high risk to data confidentiality and integrity.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized database operations, including data extraction, credential theft, and potentially remote file reading from the server hosting the PostgreSQL database. This compromises the entire data layer and could lead to full system compromise depending on the database service account privileges and server configuration.

Recommendation

  • Upgrade NocoBase plugin-collection-sql to a patched version beyond 2.2.28 immediately.
  • Review all database collection configurations in NocoBase for unauthorized or unexpected modifications to field definitions.
  • Restrict administrative or privileged access to the NocoBase instance to only trusted users to mitigate the risk of malicious exploitation of this feature.
  • Implement strict database permission controls, ensuring the PostgreSQL service account operates with the principle of least privilege, specifically restricting access to system tables and sensitive filesystem functions.
]]>highadvisorysql-injectionvulnerabilityweb-application