CVE-2026-62362: PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint
PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so unrecognized field names are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation can read all data in the PeerBanHelper database. This issue is fixed in version 9.3.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PeerBanHelperto a version that resolves this vulnerability.Fixed in 9.3.15
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can send requests to the /api/statistic/analysis/field endpoint can supply a crafted field parameter. No user interaction is required.
Which deployments are affected?
PeerBanHelper versions from 5.0.0 through versions before 9.3.15 are affected. The vulnerable interpolation is present in the SQLite, MySQL, and PostgreSQL mappers.
What data could be exposed?
Successful exploitation can allow reading all data in the PeerBanHelper database. The provided impact information does not indicate data modification or service disruption.
How can I remediate this issue?
Upgrade PeerBanHelper to version 9.3.15, which fixes the issue.