CVE-2026-24913
SQL Injection in MATCHA INVOICE 2.6.6 Allows Data Access
Publication date: 2026-04-08
Last updated on: 2026-04-17
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| icz | matcha_invoice | to 2.6.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24913 is a SQL Injection vulnerability found in MATCHA INVOICE version 2.6.6 and earlier. This vulnerability allows an authenticated user with low privileges to execute arbitrary SQL commands by manipulating specific parameters, such as params[sort]. As a result, the attacker can obtain, alter, or delete information stored in the database.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to unauthorized access to sensitive data stored in the database, modification of that data, or even deletion of important information. This compromises the confidentiality, integrity, and availability of the database, potentially disrupting business operations and exposing sensitive information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the SQL Injection vulnerability (CVE-2026-24913) in MATCHA INVOICE 2.6.6 and earlier, users should immediately update to the latest version MATCHA INVOICE 2.6.7.
This update fixes the critical SQL injection flaw that allows authenticated users to execute arbitrary SQL commands, potentially leading to leakage, alteration, or deletion of database information.
Additionally, users are advised to follow the official upgrade instructions available on the developer blog and download the update from the official product download page.
For enhanced security, consider migrating from the open-source version (which supports only PHP 5.6 and is recommended for testing only) to the paid version that supports PHP 8.2 and offers improved security features.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL Injection vulnerability (CVE-2026-24913) in MATCHA INVOICE 2.6.6 and earlier allows an authenticated user with low privileges to obtain or alter information stored in the database. This unauthorized access or modification of sensitive data can lead to violations of data protection regulations such as GDPR and HIPAA, which require the protection of confidentiality, integrity, and availability of personal and sensitive information.
Because the vulnerability impacts confidentiality, integrity, and availability of data, it poses a significant risk to compliance with standards that mandate strict controls over data access and protection, potentially resulting in legal and regulatory consequences if exploited.
Mitigation by updating to the fixed version (MATCHA INVOICE 2.6.7) is recommended to restore compliance and reduce risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability CVE-2026-24913 is an SQL Injection in MATCHA INVOICE 2.6.6 and earlier versions, exploitable by authenticated users. Detection typically involves testing for SQL injection points in the application, especially parameters such as params[sort] that are known to be vulnerable.
To detect this vulnerability on your system, you can perform authenticated SQL injection testing by sending crafted requests to the application and observing if database errors or unexpected data responses occur.
- Use tools like sqlmap with authentication cookies or credentials to test injection points, for example: sqlmap -u "http://target/matcha_invoice" --data="params[sort]=1" --cookie="session=your_session_cookie" --risk=3 --level=5
- Manually test the vulnerable parameter by injecting SQL syntax such as a single quote (') or SQL keywords into params[sort] and observe if errors or abnormal behavior occur.
- Monitor web server logs for suspicious requests containing SQL keywords or unusual parameter values targeting params[sort].
Since the vulnerability requires authentication, ensure you have valid credentials to perform these tests safely.