Executive brief
BillaBear, a subscription billing and management system, contains a security flaw that allows authorized staff members to execute unauthorized database commands. By creating specially crafted metric filters, an attacker with account management permissions can gain full access to the underlying database. This could lead to the theft of sensitive customer data, payment information, and administrative credentials, or cause a complete service outage.
Technical details
A SQL injection vulnerability exists in BillaBear's EventRepository.php due to the use of sprintf() to interpolate user-controlled metric filter names and aggregation properties directly into SQL strings. While filter values are properly parameterized, the filter identifiers (keys) used as JSONB keys (properties->>'%s') are not sanitized or quoted. This is a second-order injection: an attacker with ROLE_ACCOUNT_MANAGER permissions can submit a malicious payload via the /app/metric endpoint, which is then executed when the system performs usage calculations for billing, invoicing, or reporting. Successful exploitation allows for full database compromise, including data exfiltration and privilege escalation. All versions prior to January 2026 (specifically up to 2025.01.03) are affected.
Affected products
- BillaBear Ltd BillaBear <= 2025.01.03
Timeline
- 2026-05-19: disclosed: Initial disclosure and NVD publication
- 2026-05-19: advisory: GitHub Advisory GHSA-xp6r-8pcc-xv5p published