CyberRota Analysis
AI-GeneratedReactPress versions prior to 3.7.0 are vulnerable to SQL injection due to the use of unsanitized HTTP query parameter names as SQL column identifiers in API list endpoints. This flaw allows unauthenticated attackers to manipulate database queries, potentially leading to unauthorized data access or modification. Organizations using affected versions should prioritize upgrading to 3.7.0 or implementing a workaround to allowlist filter column names to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.