Executive brief
NodeBB is a community discussion and forum platform. An unauthenticated attacker can inject malicious SQL code through the search endpoint, potentially exposing sensitive database information and compromising the integrity of stored data. This could lead to unauthorized access to forum content, user accounts, or configuration data.
Technical details
NodeBB v4.3.0 contains a SQL injection vulnerability in the /api/v3/search/categories API endpoint where the search query parameter is not properly sanitized before being used in SQL queries. The vulnerability allows unauthenticated remote attackers to inject boolean-based blind and PostgreSQL error-based SQL payloads. No authentication or user interaction is required; the endpoint is directly exploitable via HTTP requests. An attacker can extract sensitive database information, modify or delete records, and potentially escalate privileges depending on database permissions. A patch addressing the input sanitization issue is recommended.
Affected products
- NodeBB NodeBB 4.3.0 and earlier
Timeline
- 2025-08-27: disclosed: Vulnerability published to GitHub advisory database