PeerBanHelper CVE-2026-62362

Exploitation requires an authenticated session against the PeerBanHelper web API (PR:H - a privileged/admin panel user) and the ability to reach the /api/statistic/analysis/field endpoint, which routes to countField or sumField. The specific trigger is supplying a 'field' query parameter whose value is NOT one of the recognized field names, because mapField() passes unrecognized names straight into the ${field}-interpolated SQL; recognized field names are not injectable. Affected versions are 5.0.0 up to (but not including) 9.3.15 across any backing database (SQLite, MySQL, or PostgreSQL). The primary limiting factor is the prerequisite of valid high-privilege credentials; there is no user-interaction requirement and no non-default configuration needed beyond a running, reachable instance on an affected version.

This is a medium-severity issue (CVSS 4.9) whose real-world risk is constrained primarily by its authentication requirement. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable, low-complexity attack but one requiring high privileges (PR:H) - i.e., an already-authenticated administrator of the PeerBanHelper web UI/API. Impact is confined to confidentiality (C:H: full read of the PeerBanHelper database) with no integrity or availability impact (I:N/A:N), consistent with a read-oriented SQL injection in the /api/statistic/analysis/field endpoint. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - therefore no public exploit identified at time of analysis. No SSVC decision data was provided. The signals are internally consistent (no conflicts between CVSS vector and description), but the headline risk is dampened by the fact that an attacker must first hold valid high-privilege credentials, which largely reduces this to a post-authentication data-disclosure / privilege-boundary weakness rather than a mass-exploitable remote flaw. Note that EPSS, KEV, and POC signals are all absent rather than confirmed-negative, so this reflects lack of evidence of exploitation, not proof of none.

An attacker who already possesses valid PeerBanHelper web-panel credentials sends a request to /api/statistic/analysis/field with a crafted 'field' query parameter. Because mapField() forwards unrecognized field names unsanitized into a ${field} string-interpolated SQL statement, the attacker injects SQL that is executed by the SQLite, MySQL, or PostgreSQL mapper, allowing them to read arbitrary data from the PeerBanHelper database. No public PoC is referenced, though the fixing commit clearly illustrates the vulnerable code path.