BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.

A SQL injection vulnerability was discovered in BigBlueButton, an open-source virtual classroom platform, affecting versions prior to 3.0.23. Authenticated moderators could exploit the flaw by injecting malicious SQL through the meetingId and userId parameters used in the refreshBreakoutRoomsVisibleForUsers method. The vulnerable code is located in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala, where user-supplied values were directly interpolated into SQL queries without proper sanitization. This allowed attackers with moderator privileges to execute arbitrary SQL against the application database. The vulnerability poses a significant risk as it could lead to unauthorized data access, modification, or deletion. The issue has been patched in BigBlueButton version 3.0.23, with the fix available via an official GitHub commit and release.