CVE-2026-54790: InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

Published Sep 25, 2026
·
Updated

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used() later concatenates that stored value into the FROM table and WHERE column identifier positions, so opening the custom-field edit form executes a second-order SQL injection. The injection can query arbitrary schema data and can cause application errors or denial of service. This issue is fixed in version 1.7.2.

Affected Software

1 affected component
InvoicePlane InvoicePlane<1.7.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade InvoicePlane to a version that resolves this vulnerability.

    Fixed in 1.7.2

Event History

Sep 25, 2026
CVE Published
via MITRE·03:19 PM
Data Sourced
via MITRE·03:19 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

An attacker needs administrator-level privileges to set the custom_field_table value in the Custom Fields module. The injected SQL is triggered later when the custom-field edit form is opened.

2

Which deployments are affected?

InvoicePlane versions prior to 1.7.2 are affected. The issue requires use of the Custom Fields module and an administrator-controlled custom_field_table value that is not restricted to allowed table names.

3

What is the impact of successful exploitation?

The injection can query arbitrary database schema data. It can also produce application errors or denial of service.

4

What should be done if an immediate upgrade is not possible?

Restrict administrator access to trusted users and review custom_field_table values in the Custom Fields module for unexpected or invalid table names. Avoid opening custom-field edit forms associated with suspicious values until they are corrected.

5

How can an organization determine whether it is exposed?

Check the InvoicePlane version and upgrade to 1.7.2 if it is older. For older installations, inspect Custom Fields configuration for custom_field_table entries that are not allowed custom-field table names.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203