Nextcloud's Tables app versions 0.9.0 to <0.9.7 and 1.0.0 to <1.0.2 contain a SQL injection vulnerability due to missing sanitization in the ORDER BY statement of a query. This vulnerability allows an authenticated user with access to the Tables app to perform a limited SQL injection attack, which can extract a single bit of information per request or cause the database to delay responses. The issue is fixed in versions 0.9.7 and 1.0.2.

Successful exploitation can lead to unauthorized disclosure of information from the database by extracting bits of data through the ORDER BY clause. The vulnerability does not allow modification of data (integrity impact is none) but can cause limited denial of service by making the database wait. The CVSS vector indicates high confidentiality impact, low attack complexity, and requires privileges (user access to the Tables app). No known exploits have been reported in the wild.

Upgrade Nextcloud Tables app to version 0.9.7 or later, or 1.0.2 or later, where the vulnerability is patched. Since this is an application-level vulnerability, applying these official fixes is the recommended remediation. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.