CVE-2025-50979: SQL Injection Flaw in NodeBB Forum Software, PoC Available

CVE-2025-50979 is a SQL injection vulnerability in NodeBB Forum Software versions up to v4.3.0, with a CVSS score of 8.6, disclosed by the developers of NodeBB. According to CVE description, NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories), where the search query parameter is not properly sanitised, allowing unauthenticated remote attackers to inject boolean-based blind and PostgreSQL error-based payloads.

Security researchers demonstrated the flaw using the penetration testing tool sqlmap, confirming the potential for automated exploitation, with a PoC test command that used tamper scripts such as least, charencode and escapequotes to bypass input sanitisation. In practical terms, exploitation could enable enumerating databases and extracting sensitive forum data, accessing user credentials or private messages stored in SQL databases, or causing denial of service. The article notes that an official patch has been released and administrators are advised to upgrade to the latest version, v4.4.6, as soon as possible.