CVE-2026-55386

7.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-89

Impact

Authenticated attackers can exfiltrate sensitive database contents via blind SQL injection. They only need low-privilege application access to supply crafted query parameters to list endpoints.

Root cause

The application passes the user-supplied orderByField parameter directly to Laravel's orderBy clause in Invoice::scopeApplyFilters without sanitizing or restricting it to valid column names.

Affected systems

InvoiceShelf prior to version 2.4.0

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade InvoiceShelf to version 2.4.0 or later. If updating immediately is not possible, apply WAF rules to reject requests containing SQL syntax or non-alphanumeric characters in the orderByField query parameter.

shell

$ git pull && git checkout v2.4.0 && composer install --no-dev --optimize-autoloader

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55386