SQL Injection in Capgo Analytics Platform

Impact Analysis

If exploited by an attacker with platform admin credentials, this vulnerability can lead to unauthorized enumeration of database schemas, extraction of sensitive analytics data, and denial-of-service attacks against the analytics backend.

The impact includes potential exposure of sensitive information and disruption of analytics services, which could affect the availability and confidentiality of data.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56281 is a SQL injection vulnerability in the Capgo application affecting versions before 12.128.2. It occurs in the POST /private/admin_stats endpoint where the 'limit' parameter is taken from an unvalidated request body and directly inserted into SQL queries via JavaScript template literals.

Although other parameters are validated by a Zod schema, 'limit' and 'offset' are not validated properly, allowing an attacker with platform admin credentials to inject malicious SQL fragments.

This vulnerability can be exploited to enumerate database schemas, extract analytics data, or cause denial-of-service attacks against the analytics backend.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring requests to the POST /private/admin_stats endpoint for suspicious or malformed 'limit' parameter values that could indicate SQL injection attempts.

Since the vulnerability requires platform admin credentials and exploits the 'limit' parameter in the request body, inspecting logs for unusual or unexpected SQL fragments in this parameter can help identify exploitation attempts.

Specific commands are not provided in the available resources, but general approaches include:

• Using web application firewall (WAF) logs or intrusion detection system (IDS) alerts to flag suspicious POST requests to /private/admin_stats.
• Searching server logs for POST requests containing unusual characters or SQL keywords in the 'limit' parameter.
• Employing tools like grep or similar to scan access logs, for example: grep -i 'POST /private/admin_stats' /var/log/nginx/access.log | grep -E 'limit=.*(union|select|--|;)'

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Capgo to version 12.128.2 or later, where the vulnerability is fixed by adding proper validation for the 'limit' and 'offset' parameters in the Zod schema and ensuring these values are destructured from validated data.

Until the upgrade can be applied, restrict platform admin access to trusted users only, as exploitation requires high privileges.

Additionally, monitor and block suspicious requests to the /private/admin_stats endpoint, and consider implementing input validation or WAF rules to detect and prevent SQL injection attempts targeting the 'limit' parameter.

Useful 0 Not Useful 0