InvoiceShelf, an open‑source accounting application, permitted users to supply an orderByField query parameter that was directly passed into Laravel's orderBy function without validation. This allowed a malicious user to inject a crafted SQL expression into the ORDER BY clause of invoice and other list endpoints, enabling Boolean‑based blind extraction of database information. The flaw results in an impact of information disclosure and can be exploited remotely by an attacker with network access to the application, but only when the attacker is authenticated, as the vulnerability is present in the web interface and is restricted to authenticated users. The CVE is scored CVSS 7.1, indicating a high severity logical flaw in application logic. This risk was discovered and fixed in version 2.4.0.

The affected product is InvoiceShelf. All releases prior to 2.4.0 are impacted. The repair is included in release 2.4.0 and later versions do not contain the vulnerability.

The CVSS score of 7.1 reflects a high severity flaw. No EPSS score is available, so the relative likelihood cannot be quantified. The issue is not listed in the CISA KEV catalog, indicating no known public exploitation at the time of analysis. Based on the description, the likely attack vector is remote exploitation via a crafted HTTP request to the affected API endpoints, but only when the attacker is authenticated. An authenticated attacker who can send requests to the application can leverage the unsanitized orderByField parameter to conduct blind data extraction by observing changes in query execution time or other observable side effects.