Support Board CVE-2026-4815

Requires authenticated access to Support Board v3.7.7. Attacker must be a logged-in user to exploit SQL injection via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint. No victim interaction needed.

This vulnerability presents a HIGH real-world risk despite the absence of CVSS and EPSS scores in the provided data. The attack vector is almost certainly Network-based given the AJAX endpoint exposure, and the vulnerability likely has low attack complexity given the straightforward parameter injection mechanism. The technical impact is CRITICAL—SQL injection against a support board application enables complete database compromise, including extraction of sensitive customer interactions, user authentication credentials, and potentially personally identifiable information. The availability of a vendor patch (as confirmed by INCIBE) suggests this is a known, reproducible issue. The lack of active KEV designation does not diminish risk; rather, the combination of CRITICAL technical impact (CRUD operations on database), public disclosure via INCIBE, and patch availability indicates this is a priority issue for Support Board deployments. Organizations using affected versions should treat this as requiring urgent patching within days, not weeks.

An attacker discovers the Support Board instance at a public URL and identifies the vulnerable '/supportboard/include/ajax.php' endpoint through reconnaissance or error messages. The attacker crafts a malicious HTTP POST request with SQL injection payloads in the 'calls[0][message_ids][]' parameter, such as a UNION-based injection to extract user tables or a time-based blind injection to confirm the vulnerability. With no parameterized query protection in place, the injected SQL executes in the context of the database connection, allowing the attacker to dump customer support tickets, extract password hashes, or insert administrative users without authentication. If proof-of-concept code becomes publicly available following the INCIBE disclosure, exploitation difficulty decreases significantly, making this a high-priority target for automated scanning and mass exploitation campaigns.