EUVD-2026-30946
GHSA-xp6r-8pcc-xv5p
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands.
AnalysisAI
SQL injection in BillaBear (all versions prior to January 2026) allows authenticated users holding the ROLE_ACCOUNT_MANAGER role to execute arbitrary SQL commands via the EventRepository component. The flaw stems from unsanitized filter identifier keys being concatenated into queries through sprintf(), and while no public exploit identified at time of analysis is listed in KEV, two CVE-referenced gists suggest detailed technical write-ups are publicly available. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Audit all BillaBear deployments; restrict ROLE_ACCOUNT_MANAGER access to only essential personnel; disable account manager module access if operationally feasible. 7 days: Implement database activity monitoring with anomaly detection; enforce multi-factor authentication for account manager accounts; apply network-level restrictions to database access. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today