CVE-2025-67082: InvoicePlane SQL Injection Vulnerability

CVE-2025-67082 Overview

CVE-2025-67082 is an SQL injection vulnerability in InvoicePlane through version 1.6.3. The flaw exists in the maxQuantity and minQuantity parameters used during report generation. An authenticated attacker can exploit the issue through error-based SQL injection to extract arbitrary data from the underlying database. The vulnerability stems from insufficient sanitization of single-quote characters in user-supplied input. InvoicePlane is an open-source invoicing application used by small businesses and freelancers to manage quotes, invoices, and payments, making exposed instances attractive targets for data theft.

Critical Impact
Authenticated attackers can extract sensitive database contents, including customer records, invoice data, and credentials, through error-based SQL injection in the report generation feature.

Affected Products

InvoicePlane through version 1.6.3
All deployments exposing the report generation functionality
Self-hosted InvoicePlane instances with authenticated user access

Discovery Timeline

2026-01-15 - CVE-2025-67082 published to NVD
2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-67082

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89]. It affects the report generation workflow in InvoicePlane through 1.6.3. The maxQuantity and minQuantity parameters are concatenated into a SQL query without proper escaping of single quotes. An authenticated attacker submits crafted input that breaks out of the intended query context. The database returns error messages that leak data values back to the attacker. This error-based technique allows incremental extraction of rows and columns from any accessible table.

Exploitation requires valid authentication to the InvoicePlane application but does not require administrative privileges. The attack is conducted over the network against the web interface. Successful exploitation discloses confidential information stored in the database, including client records, financial data, and password hashes.

Root Cause

The root cause is improper neutralization of special elements in SQL commands. The report-generation logic builds queries through string concatenation using values from the maxQuantity and minQuantity HTTP parameters. Single-quote characters are not escaped or parameterized, allowing the attacker to terminate string literals and append arbitrary SQL syntax. Refer to the Helx Blog Advisory for technical details on the affected code path.

Attack Vector

The attack is performed remotely over HTTP against an authenticated session. An attacker logs in with low-privileged credentials and navigates to the report generation interface. The attacker then injects SQL syntax through the maxQuantity or minQuantity request parameters. Crafted payloads trigger database errors whose content reflects results of subqueries chosen by the attacker. Through repeated requests, the attacker enumerates schema objects and extracts row data without needing UNION-based or blind techniques.

No public proof-of-concept exploit code is currently listed for this CVE. See the InvoicePlane GitHub repository for upstream code and issue tracking.

Detection Methods for CVE-2025-67082

Indicators of Compromise

HTTP POST or GET requests to the report generation endpoint containing single quotes, SQL keywords, or comment markers in the maxQuantity or minQuantity parameters
Web server or PHP error logs showing MySQL syntax errors referencing report queries
Unusual volume of report-generation requests from a single authenticated session
Database error responses returned to the client containing fragments of SQL syntax

Detection Strategies

Inspect web server access logs for maxQuantity and minQuantity parameter values containing characters such as ', --, UNION, SELECT, or EXTRACTVALUE
Deploy a web application firewall rule that flags SQL metacharacters in numeric parameters
Correlate authenticated user sessions with high error rates from the database tier
Monitor for sequential requests that progressively enumerate database schema information

Monitoring Recommendations

Enable verbose query logging on the MySQL or MariaDB instance backing InvoicePlane during incident response
Alert on application errors emitted by the PHP runtime that include SQL state codes
Track authentication events for accounts that subsequently access the reporting module
Review audit logs for unexpected administrative or bulk data access following report requests

How to Mitigate CVE-2025-67082

Immediate Actions Required

Restrict access to the InvoicePlane interface using network controls until a patched release is deployed
Audit existing InvoicePlane user accounts and disable any unused or shared credentials
Review database and application logs for indicators of prior exploitation against the report endpoint
Ensure the application database user holds only the minimum privileges required for InvoicePlane operation

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry beyond noting that all releases through 1.6.3 are affected. Monitor the InvoicePlane GitHub repository for an official security release and apply it once available. Until then, follow the workarounds below.

Workarounds

Place the InvoicePlane application behind a web application firewall configured to block SQL injection patterns in maxQuantity and minQuantity parameters
Limit access to the reporting feature to a trusted administrator account on an isolated network segment
Enforce strong, unique passwords and multi-factor authentication on the reverse proxy fronting the application
Reduce the privileges of the MySQL or MariaDB account used by InvoicePlane so it cannot read sensitive system tables

bash

# Example WAF rule snippet to block SQL metacharacters in vulnerable parameters
SecRule ARGS:maxQuantity|ARGS:minQuantity "@rx ['\";]|--|/\*|union|select|extractvalue" \
    "id:1006708201,phase:2,deny,status:403,log,msg:'CVE-2025-67082 InvoicePlane SQLi attempt'"