InvoicePlane is a self‑hosted application for invoice management. A flaw in the Custom Fields module lets an administrator store an unvalidated custom_field_table value. That value is later concatenated directly into an SQL query when editing custom fields, creating a second‑order SQL injection (CWE‑89). An attacker can use the injection to read arbitrary database schema information and may trigger application errors or denial of service.

The vulnerability impacts all deployments of InvoicePlane prior to version 1.7.2. Administrators using the current code base with the Custom Fields module are at risk unless they have upgraded to the patched release v1.7.2 or later.

The severity rated at CVSS 6.0 indicates moderate risk. Because the injection is second‑order, an attacker must first influence the stored custom_field_table value, which generally requires administrative access or a prior privilege‑exploiting foothold. When privileged access is achieved, the attacker can trigger schema queries or cause crashes. EPSS is currently unavailable and the issue is not listed in the CISA KEV catalog, so the threat is moderate but requires monitoring because exploitation could cause data exposure or downtime.