8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31069

CVE-2026-31069: BillaBear is Vulnerable to SQL Injection in the EventRepository

BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31069

CVE-2026-31069:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
billabear/billabear	composer	<= 2025.01.03

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic SQL injection in the EventRepository of BillaBear. The root cause is the use of sprintf() to construct dynamic SQL queries where user-controlled input, specifically metric filter names and aggregation properties, is concatenated directly into the SQL string without proper sanitization or escaping. While the filter values are parameterized, the filter identifiers (the column names) are not. This allows an authenticated attacker with ROLE_ACCOUNT_MANAGER permissions to craft a malicious filter name. This malicious payload is then stored in the database (a second-order injection) and is executed when a usage calculation is triggered, for example, during invoice generation. The vulnerable functions, createCountSql, createSumSql, createMaxSql, createLatestSql, and createCountUnique, all reside in src/BillaBear/Repository/Usage/EventRepository.php and are responsible for building and executing these flawed SQL queries. The lack of input validation in CreateMetricFilter.php for the filter name field is what makes the initial injection possible.

Vulnerable functions

BillaBear\Repository\Usage\EventRepository::createCountSql

src/BillaBear/Repository/Usage/EventRepository.php

The function is vulnerable to SQL injection because it uses `sprintf` to directly insert the user-controlled filter name (`$filter->getName()`) into the SQL query without proper sanitization or escaping. This allows an attacker to inject arbitrary SQL code.

BillaBear\Repository\Usage\EventRepository::createSumSql

src/BillaBear/Repository/Usage/EventRepository.php

This function is also vulnerable to SQL injection as it uses the same flawed pattern of building SQL queries with unescaped user input for filters, as stated in the vulnerability analysis.

BillaBear\Repository\Usage\EventRepository::createMaxSql

src/BillaBear/Repository/Usage/EventRepository.php

The function is vulnerable to SQL injection because it uses `sprintf` to directly insert the user-controlled aggregation property (`$metric->getAggregationProperty()`) into the SQL query. This allows for SQL injection.

BillaBear\Repository\Usage\EventRepository::createLatestSql

src/BillaBear/Repository/Usage/EventRepository.php

This function is also vulnerable to SQL injection as it uses the same flawed pattern of building SQL queries with unescaped user input for filters, as stated in the vulnerability analysis.

BillaBear\Repository\Usage\EventRepository::createCountUnique

src/BillaBear/Repository/Usage/EventRepository.php

This function is also vulnerable to SQL injection as it uses the same flawed pattern of building SQL queries with unescaped user input for filters, as stated in the vulnerability analysis.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.