Listen to this Post
A SQL injection vulnerability exists in MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3. The flaw resides in the client-side escaping mechanism for Buffer parameters when the connection uses specific multi-byte client character sets: big5, gbk, sjis, cp932, or gb18030.
When binding a Buffer (binary) parameter, the `PacketOutputStream.writeBufferEscape` function in `lib/io/packet-output-stream.js` escapes the value byte-by-byte, inserting a backslash (0x5C) before quote (0x27) and backslash bytes. This approach is safe under single-byte and UTF-8-family charsets. However, for the affected multi-byte charsets, the trail-byte range overlaps the ASCII backslash (0x5C).
The critical issue arises because the connector performs this escaping without the charset-aware `getMbRecognizer` logic found in lib/misc/charset-mb.js. On the server side, the SQL lexer executes the `my_ismbchar` function to recognize multi-byte characters before it processes escape sequences.
An attacker who controls a byte that the lexer treats as a valid lead byte can exploit this discrepancy. When the server receives the escaped payload, the sequence `
This is a well-known multi-byte escaping bypass, the same class that historically affected `addslashes` and `mysql_real_escape_string` under GBK/Big5. The default `utf8mb4` character set and parameters sent via the binary prepared-statement path (conn.execute()) are not affected.
DailyCVE Form:
Platform: Node.js
Version: <3.2.4, <3.3.3, <3.4.6, <3.5.3
Vulnerability: SQL Injection
Severity: Medium (CVSS 6.5)
date: 2026-08-28
Prediction: 2026-09-15
What Undercode Say:
Check your `package-lock.json` for the `mariadb` dependency version.
Check installed version npm list mariadb Update to a patched version npm install mariadb@latest
Exploit: (Educational Purposes!)
An attacker can inject SQL by providing a Buffer parameter containing a multi-byte lead byte followed by a quote. For example, with the GBK charset, the lead byte `0x81` can absorb the escaping backslash:
const payload = Buffer.from([0x81, 0x27, 0x20, 0x4F, 0x52, 0x20, 0x31, 0x3D, 0x31, 0x2F, 0x2A]); // This may result in: ... WHERE name = '膢' OR 1=1/'
The server interprets `0x81` + `\` (inserted by connector) as a single GBK character, leaving the `’` unescaped to break out of the string.
Protection:
- Upgrade to patched versions: 3.2.4, 3.3.3, 3.4.6, or 3.5.3.
- Use server-side prepared statements (
conn.execute()) instead of text queries (conn.query()). - Enforce `utf8mb4` encoding on the client connection (this is the default and is not affected).
Impact:
Successful exploitation allows an attacker to break out of the intended string literal and inject arbitrary SQL commands. This can lead to unauthorized reading or modification of data. Depending on the database account’s privileges, this could result in further compromise of the database server and underlying systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
