Chatwoot – Second Order Time-Based Blind SQL Injection via Custom Attribute Key

The custom attribute definition API allows creating attributes with arbitrary attribute_key values without validation. When these attributes are used in conversation/contact filters, the key is directly interpolated into SQL queries in build_custom_attr_query, enabling stored SQL injection. An attacker can create a malicious custom attribute once, then trigger the injection whenever that attribute is used in a filter.