Summary
ReactPress API list endpoints construct database query conditions from HTTP query parameter names without validating them as SQL identifiers. Because values are parameterized but column names are interpolated, unauthenticated attackers may inject SQL through crafted query-string keys when these endpoints are exposed.
Affected context
The vulnerability occurs in ReactPress deployments using API list endpoints that translate query parameters into TypeORM QueryBuilder conditions. It becomes risky when attacker-controlled parameter names are incorporated into SQL column expressions without an allowlist or equivalent identifier validation.
Exploit preconditions
- Attack surface: Public ReactPress API list endpoints
- Required access: No authentication may be required when the affected endpoints are externally accessible
- Trigger point: Processing HTTP query-string parameter names as database filter identifiers
- Why exploitation is possible: TypeORM parameterizes values but does not automatically sanitize dynamically interpolated column names, allowing SQL syntax to enter the generated query
Why this happens
The underlying bug is SQL injection caused by treating untrusted HTTP parameter names as trusted database identifiers. The application interpolates a user-controlled key into a QueryBuilder column expression, such as an entity alias and key, without restricting it to known-safe fields. This maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, because attacker-controlled input can alter the intended structure of a database query.
Potential impact
- An attacker could read unauthorized database records
- An attacker could modify or delete stored content, depending on database permissions
- Sensitive application or user information may be disclosed
- Database availability could be affected through disruptive queries
- Compromised database credentials or privileges could enable broader application impact
General mitigation guidance
Mitigation should focus on separating trusted database identifiers from untrusted request data.
Common defensive patterns include:
- Allowlisting accepted filter column names before building queries
- Mapping public filter names to fixed internal entity fields rather than interpolating raw keys
- Continuing to use parameterized bindings for all user-controlled values
- Rejecting unknown, malformed, or structurally invalid filter parameters
- Applying least-privilege permissions to the database account used by the application
- Restricting sensitive fields and operations from public API filtering
- Adding regression tests for identifier validation and query construction
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving string interpolation of request keys into SQL or ORM query expressions
- Code review signals such as dynamic property names passed to QueryBuilder column, order, group, or filter clauses
- API tests using unexpected parameter names and verifying that they are rejected rather than incorporated into queries
- Database audit logs showing anomalous query structures, unexpected errors, or access to restricted tables
- Policy enforcement requiring explicit field mappings for externally supplied sort and filter parameters
- Automated security review tools that identify unsanitized input reaching SQL construction APIs
