{"id":"CVE-2026-62362","kind":"vulnerability","aliases":["CVE-2026-62362"],"related":[],"title":"PeerBanHelper: authenticated SQL injection through statistics field parameter exposes database","description":"PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so unrecognized field names are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation can read all data in the PeerBanHelper database. This issue is fixed in version 9.3.15.","summary":"PeerBanHelper, a BitTorrent peer-blocking tool, passes an unsanitized field query parameter from its statistics analysis endpoint directly into SQL queries. An authenticated user can read all data in the PeerBanHelper database.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","package","peerbanhelper","postgresql","self-hosted","sqlite"],"not_affected_if":["no-authenticated-users-besides-admin","version-9.3.15-or-later"],"how_to_check":"- Check the installed PeerBanHelper version; versions from 5.0.0 up to but not including `9.3.15` are affected\n- Confirm whether the web interface or API is reachable beyond trusted users, since exploitation requires an authenticated account","fix":"- Upgrade PeerBanHelper to `9.3.15`\n- Until upgraded, restrict access to the web interface and rotate any credentials stored in the database","status":"open","published_at":"2026-10-16T17:17:35+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:32:54+00:00","updated_at":"2026-10-25T04:32:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:32:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PeerBanHelper to `9.3.15`\n- Until upgraded, restrict access to the web interface and rotate any credentials stored in the database","reach":"network","title":"PeerBanHelper: authenticated SQL injection through statistics field parameter exposes database","impact":"medium","summary":"PeerBanHelper, a BitTorrent peer-blocking tool, passes an unsanitized field query parameter from its statistics analysis endpoint directly into SQL queries. An authenticated user can read all data in the PeerBanHelper database.","category":"package","nicknames":[],"who_cares":["self-hosted","peerbanhelper","sqlite","mysql","postgresql"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated user reads all data in the PeerBanHelper database","analyst_note":"","how_to_check":"- Check the installed PeerBanHelper version; versions from 5.0.0 up to but not including `9.3.15` are affected\n- Confirm whether the web interface or API is reachable beyond trusted users, since exploitation requires an authenticated account","needs_analyst":false,"not_affected_if":["version-9.3.15-or-later","no-authenticated-users-besides-admin"],"who_is_affected":"Teams running PeerBanHelper between versions 5.0.0 and 9.3.14 where users with a valid login can reach the statistics API. Exposure depends on who holds accounts on the instance; instances limited to a single trusted operator carry lower risk. Teams on 9.3.15 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3444,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62362':13A,16A '/api/statistic/analysis/field':77C '5.0.0':73C '9.3.15':75C,138C 'abnorm':64C 'accept':79C 'across':115C 'analysi':41B 'authent':2A,48B,87C 'automat':59C 'bittorr':27B,65C 'block':30B,60C 'cloud':70C 'countfield':93C 'craft':81C 'customiz':68C 'cve':11A,14A 'data':53B,127C 'databas':10A,57B,131C 'direct':43B 'endpoint':42B,78C 'exploit':123C 'expos':9A 'field':7A,35B,82C,101C,107C,114C 'fix':135C 'forward':99C 'host':23B 'inject':4A 'interpol':110C 'issu':133C 'leech':62C 'mapfield':97C 'mapper':121C 'method':98C 'mysql':17B,118C 'name':102C,108C 'packag':18B 'paramet':8A,37B,84C 'pass':32B,90C 'peer':29B,66C 'peer-block':28B 'peerbanhelp':1A,19B,25B,56B,58C,130C 'postgresql':20B,120C 'queri':36B,46B,83C 'read':51B,125C 'rule':71C 'sanit':104C 'self':22B 'self-host':21B 'sql':3A,45B,112C 'sqlite':24B,117C 'statist':6A,40B 'success':122C 'sumfield':95C 'tool':31B 'unrecogn':100C,106C 'unsanit':34B 'unwant':61C 'use':67C 'user':49B,88C 'version':137C 'without':103C","nicknames":[],"mitigations":[],"who_affected":"Teams running PeerBanHelper between versions 5.0.0 and 9.3.14 where users with a valid login can reach the statistics API. Exposure depends on who holds accounts on the instance; instances limited to a single trusted operator carry lower risk. Teams on 9.3.15 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T17:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62362","severity":null,"published_at":"2026-10-16T17:17:35+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}