PeerBanHelper allows a crafted user-supplied field query parameter to the /api/statistic/analysis/field endpoint, which is forwarded unvalidated to the countField or sumField methods. The mapField() routine does not sanitize unknown field names, resulting in direct string interpolation into SQL commands via ${field} in the SQLite, MySQL, and PostgreSQL mappers. This flaw permits an authenticated user to run arbitrary SQL queries and read every table in the PeerBanHelper database. The vulnerability is a classic SQL injection (CWE-89) and can lead to full data exposure.

The bug affects PeerBanHelper versions 5.0.0 through 9.3.15 released by PBH-BTN. Any deployment using the /api/statistic/analysis/field endpoint with a database backend – SQLite, MySQL, or PostgreSQL – is vulnerable to data disclosure until the release of v9.3.15 or later, which removes the unsanitized field interpolation.

The CVSS score of 4.9 indicates moderate severity; the EPSS score is not available, so current exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the API, suggesting that an attacker must first obtain valid credentials or compromise a legitimate user account. Once authenticated, the attacker can directly read all database contents, compromising confidentiality but not system availability.