Executive brief
V2Board is a management panel for proxy protocols. A security vulnerability in the administrative interface allows an authorized administrator to perform unauthorized database queries. This could lead to the exposure of sensitive information, such as user passwords and authentication tokens, by manipulating how data is sorted in the dashboard.
Technical details
A SQL injection vulnerability exists in V2Board versions up to and including 1.7.4 within the `app/Http/Controllers/Admin/UserController.php` component. The application fails to validate or sanitize the `sort` parameter before passing it to the `User::orderBy()` method, allowing for direct concatenation into the SQL query. An authenticated attacker with administrative privileges can exploit this to perform blind SQL injection or order-based inference to disclose sensitive fields such as `password` and `remember_token`. The project is reportedly unmaintained, and no official patch is available; users are advised to manually implement allowlist validation for sorting columns.
Affected products
- V2Board V2Board thru 1.7.4
Timeline
- 2026-04-30: disclosed: Vulnerability discovered by Innora Security Research
- 2026-05-01: advisory: CVE published to NVD