{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afecommunityreactpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fecommunity:reactpress:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-61685"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["reactpress (\u003c= 3.6.0)"],"_cs_severities":["high"],"_cs_tags":["sqli","vulnerability","api-security"],"_cs_type":"advisory","_cs_vendors":["fecommunity"],"content_html":"\u003cp\u003eReactPress versions 3.6.0 and earlier contain a critical SQL injection vulnerability (CVE-2026-61685) due to improper handling of dynamic column names within its API. The application uses unsanitized HTTP query parameter names directly in TypeORM QueryBuilder conditions, specifically constructing identifiers like \u003ccode\u003earticle.${key}\u003c/code\u003e. While TypeORM parameterizes values, it does not parameterize column identifiers, allowing an attacker to inject SQL syntax through crafted query keys. This vulnerability affects multiple endpoints including /api/article, /api/comment, /api/file, /api/page, and /api/Knowledge. Successful exploitation allows an unauthenticated remote attacker to perform blind SQL injection, leading to the unauthorized exfiltration of sensitive data such as user credentials, system settings, and proprietary content.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a ReactPress instance exposed to the internet.\u003c/li\u003e\n\u003cli\u003eAttacker inspects the API structure and identifies susceptible GET endpoints (/api/article, /api/comment, /api/file, /api/page, /api/Knowledge).\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET request containing malicious SQL fragments within a query parameter key (e.g., \u003ccode\u003e?some_col=value\u003c/code\u003e is replaced with \u003ccode\u003e?1=1;--=value\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe ReactPress server parses the query parameter key and dynamically constructs a TypeORM QueryBuilder statement using the malicious key as a column identifier.\u003c/li\u003e\n\u003cli\u003eThe resulting unsanitized query is sent to the underlying database driver.\u003c/li\u003e\n\u003cli\u003eThe database executes the injected SQL commands alongside legitimate queries.\u003c/li\u003e\n\u003cli\u003eAttacker uses boolean-based or time-based blind SQL injection techniques to extract data character by character based on the server response or latency.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized access to the application database. An attacker can exfiltrate sensitive information, including user records, system configurations, API keys, and article contents. The vulnerability is highly impactful due to its unauthenticated nature, allowing complete compromise of the database layer.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to \u003ccode\u003e@fecommunity/reactpress\u003c/code\u003e version 3.7.0 or higher immediately to patch CVE-2026-61685.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement a WAF or API gateway rule to inspect and reject incoming HTTP GET requests that contain suspicious SQL syntax or illegal characters within query parameter keys.\u003c/li\u003e\n\u003cli\u003eImplement strict allow-listing for all query parameters accepted by the API endpoints listed in this brief.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-24T01:57:11Z","date_published":"2026-09-24T01:57:11Z","id":"https://feed.craftedsignal.io/briefs/2026-09-reactpress-sqli/","summary":"An unauthenticated SQL injection vulnerability in ReactPress allows attackers to exfiltrate database contents via malicious HTTP query parameter keys in API requests.","title":"SQL Injection in ReactPress API via Unsanitized Query Parameter Names","url":"https://feed.craftedsignal.io/briefs/2026-09-reactpress-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:fecommunity:reactpress:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}