Executive brief
kaiten is a project management and team collaboration platform. The application contains a SQL injection vulnerability in the card listing API that allows authenticated users to inject arbitrary SQL commands through sorting parameters, potentially enabling unauthorized database access, data theft, or data manipulation.
Technical details
The vulnerability is a boolean-blind SQL injection (CWE-89) in the GET parameters order_by and order_direction of the /api/cards endpoint. Dynamic SQL statements are constructed without proper input validation or parameterized queries. The attack requires prior authentication (PR:L) and network access (AV:N), and the attacker can read, modify, and delete database contents across all security boundaries (S:C with C:H/I:H/A:H). Exploitation has been demonstrated using sqlmap targeting the order_by parameter via boolean-blind techniques. Versions 57.192.20 through before 57.214.26 are affected; a patch is available in version 57.214.26 or later.
Affected products
- kaiten 57.192.20 to before 57.214.26
Timeline
- 2026-09-15: disclosed