Description

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-21T21:17:14.273Z",
  "pubdate": "2026-09-21T21:17:14.273Z",
  "executiveSummary": "A critical SQL injection vulnerability exists within the checkSQL function of NocoBase v2.1.21. This security flaw allows unauthenticated or authenticated attackers to manipulate database queries by injecting arbitrary SQL commands through unsanitized input parameters.\nThe vulnerability resides in the application's data processing logic, specifically where user-supplied input is insufficiently validated before being concatenated into database queries. Successful exploitation permits unauthorized access to sensitive database contents, including administrative credentials, proprietary business data, and system configuration information.\nThe impact is significant, potentially leading to full database compromise, data exfiltration, or unauthorized modification of system records. Given the nature of SQL injection, this vulnerability poses a severe threat to the confidentiality, integrity, and availability of the NocoBase instance. No specific authentication requirements are inherently stated to bypass the vulnerability, suggesting that network-exposed instances are at heightened risk of compromise.",
  "technicalDetails": "The vulnerability is localized to the checkSQL function within the NocoBase framework, version 2.1.21. The root cause is the failure to employ parameterized queries or robust input sanitization mechanisms when processing data passed to this function. By failing to treat user input as data rather than executable code, the application permits an attacker to alter the intended structure of the SQL query.\nThe attack flow begins when an attacker identifies an endpoint or interface that utilizes the checkSQL function. The attacker provides a crafted payload containing SQL syntax—such as UNION SELECT statements, boolean-based inference strings, or time-based injection sequences—intended to manipulate the original query logic. Because the application logic fails to encapsulate the input, the database engine executes the injected SQL commands with the privileges assigned to the database user account used by NocoBase.\nExploitation allows for several post-exploitation scenarios. An attacker can use UNION-based techniques to append results from system tables (e.g., pg_catalog or information_schema) to the application's legitimate response, facilitating the enumeration of database schemas, table names, and column contents. Furthermore, blind SQL injection techniques can be utilized to extract data character-by-character if the direct application response is suppressed.\nThe vulnerable component, checkSQL, acts as an improperly secured bridge between user-supplied input and the database backend. Since the injection occurs at the application level, it bypasses standard application-layer security controls that do not inspect the semantics of the query being constructed. The risk is amplified in scenarios where the NocoBase database user has excessive permissions, such as the ability to read from sensitive system tables or perform administrative functions within the database management system (DBMS).\nAffected versions are strictly limited to NocoBase v2.1.21. The exploitation does not necessarily require deep system-level access; it relies primarily on the ability to interact with the web interface or API exposed by the NocoBase application. The lack of proper query parameterization remains the primary technical failure point throughout the interaction cycle."
}