Technical impact
The vulnerability resides in OpenProject’s cost reporting module. The =n operator in modules/reporting/lib/report/operator.rb embeds user‑supplied text directly into SQL WHERE clauses without parameterization, creating a classic SQL injection flaw (CWE‑89). An attacker who controls this input could inject arbitrary SQL, potentially reading, modifying, or deleting sensitive project data or even executing privileged database commands, thereby compromising confidentiality, integrity, and availability.
Affected Systems
Any OpenProject installation running a version older than 17.2.3 is susceptible. The security team has released a patch in release 17.2.3 that eliminates the vulnerable code. Administrators should verify the current version and upgrade promptly; no later versions are known to retain the flaw.
Risk and Exploitability
The flaw is scored as CVSS 9.9, indicating a high‑severity risk. EPSS information is not provided, and the issue is not yet listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting limited evidence of active exploitation. The likely attack vector is remote, via the web interface, and the cost‑reporting functionality may be accessible without authentication, making the condition for exploitation straightforward. Once an attacker supplies crafted input to the =n operator, they can manipulate the database query to achieve the outcomes described above.
