Description

SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue through internal security review and remediated it on 2026-08-12; no customer action is required.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T06:17:00.103Z",
  "pubdate": "2026-10-12T06:17:00.103Z",
  "executiveSummary": "The Flock Night Shift hosted service was found to contain a SQL injection vulnerability within its bulk license plate search functionality.\nThis vulnerability allowed an authenticated user to bypass logical data boundaries and access sensitive data belonging to other customer organizations.\nThe impact was limited to unauthorized data retrieval, specifically license plate recognition records; no data modification or administrative control was achieved.\nThe risk implication is a significant breach of multi-tenant data isolation, potentially exposing sensitive surveillance metadata across the platform's customer base.\nExploitation requires an authenticated user account within the system, but does not necessitate elevated administrative privileges or specific external network exposure beyond the standard service interface.\nFlock identified the vulnerability through internal security audit procedures and deployed a server-side remediation on 2026-08-12.",
  "technicalDetails": "The vulnerability originates from improper neutralization of user-supplied input within the bulk license plate search query parameters of the Flock Night Shift application.\nThe root cause is a failure to implement parameterized queries or adequate input sanitization when processing search strings intended for the backend database management system (DBMS).\nBecause the application operates as a multi-tenant environment, the underlying SQL architecture relies on specific filters to partition data per organization ID. The vulnerability allowed the injection of malicious SQL syntax into the license plate input field, which effectively nullified or bypassed the intended WHERE clauses that enforced tenant isolation.\nAn attacker can exploit this by crafting a specific license plate string that incorporates SQL command sequences to manipulate the structure of the backend query. By injecting clauses such as UNION SELECT statements, an attacker can coerce the database into returning result sets belonging to other organizations that are typically hidden from the requester's context.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the Night Shift service; 2) The attacker navigates to the bulk search interface; 3) The attacker submits a malformed input string containing SQL injection primitives into the license plate search field; 4) The application passes this unsanitized string directly to the database execution engine; 5) The injected SQL code alters the query logic to ignore the organizational scoping filter; 6) The database returns records across different customer datasets; 7) The application renders the unauthorized data back to the attacker's interface.\nPost-exploitation impact includes the unauthorized exfiltration of license plate recognition (LPR) metadata, including timestamps, geolocation coordinates, and vehicle identifiers associated with third-party customer organizations. The scope of the vulnerability was strictly read-only, preventing attackers from executing data manipulation, deletion, or injection attacks against the integrity of the records. The vulnerability was patched on the server side on 2026-08-12, effectively neutralizing the injection vector by correcting the query handling logic."
}