CVE-2026-30951 Exploit Metadata

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

The artifact is a fully functional Node.js/Express web application that intentionally exposes a vulnerable Sequelize ORM endpoint. It includes a step-by-step guide to trigger a boolean-based SQL injection by sending a crafted JSON payload with a malicious key containing '::' to the /api/users/search endpoint, which causes the application to return all user rows instead of filtered results.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept (PoC) for CVE-2026-30951, a SQL injection vulnerability in Sequelize. The provided source code (app.js, README.md, Dockerfile, package.json) demonstrates the vulnerability as described in the CVE. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads were observed. The application logic is consistent with a legitimate educational PoC.

ClassificationExploit

Model confidence95%

AuthenticationNot required

LanguagesJavaScriptHTMLDockerfile

Target softwareSequelize

Attack typesSQL Injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes a complete, runnable application (app.js) with a vulnerable endpoint and explicit instructions (README.md) to send a malicious payload that triggers a SQL injection, causing the application to return all database rows. This constitutes code intended to exercise a vulnerability.

README.md:3README.md:59-105app.js:438-467

Requirements

The vulnerable application must be running and accessible over the network.README.md:35-57

Observed behavior

Sends a crafted JSON POST request with a malicious key 'name::text) or 1=1--' to the /api/users/search endpoint.README.md:80-89
The application returns all user rows from the database, confirming the SQL injection altered the query logic.README.md:91-95
The vulnerable endpoint passes user-controlled JSON object keys directly into a Sequelize where clause on a JSON column.app.js:460-462

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Demonstration: SQL injection via JSON key 'name::text) or 1=1--'The README and app.js code demonstrate the CVE-2026-30951 SQL injection by passing a crafted JSON key to Sequelize's where clause, which is the expected behavior of a PoC for this vulnerability.README.md:80-89app.js:460-466
Flag Definition: FLAG = process.env.FLAG || 'EQST{Fake}'A flag is defined for a CTF-style challenge, but it is only stored in the database and never exfiltrated or sent to an external server. The application does not expose the flag through any endpoint.app.js:6app.js:71-73

Review boundaries

What the analysis did not establish

One non-text media file (eqst01.png) was not analyzed.
One text file (verify.js) was omitted from the packet content.
One non-text media file (eqst01.png) was not analyzed; it is a logo image referenced in the HTML and is unlikely to contain executable code.
One text file (verify.js) was omitted from the evidence packet; its content is unknown, but the package.json lists it as a script, and the available code does not reference it in a way that suggests backdoor behavior.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

Repository root

Created 2026-04-05Vuln labCVE-2026-30951Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud · 2026-08-01

Environment assessment

A containerized Node.js application using Express, Sequelize, and SQLite that serves a web-based employee search interface. The environment is explicitly documented as a CVE-2026-30951 vulnerability playground.

README.md:1-3package.json:1-16Dockerfile:1-13

Lab assessment

Vulnerability lab

The README explicitly states the repository is a PoC for CVE-2026-30951, a SQL injection vulnerability in Sequelize v6. The application code contains a deliberately vulnerable endpoint that passes user-controlled JSON keys to a Sequelize where clause, matching the described vulnerability pattern.

README.md:1-3README.md:5-9app.js:420-440

Lab shapeDockerfile

ServicesUnknown

Compose manifests0

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

Node.js Express application

vulnerable targetweb serveremployee search API

An Express server that serves a static HTML frontend and exposes a POST /api/users/search endpoint. The endpoint accepts a JSON filter object and passes it directly to a Sequelize where clause on a JSON metadata column, enabling the documented SQL injection.

app.js:1-4app.js:420-440

SQLite database

data storevulnerability target

An in-memory or file-based SQLite database managed by Sequelize. It stores User and Flag tables. The Flag table contains a flag value from the FLAG environment variable, representing the CTF objective.

app.js:8-11app.js:22-30app.js:5

Sequelize ORM

vulnerable dependencydatabase abstraction

Sequelize v6.37.7 is used to define models and query the SQLite database. The vulnerability exists in its JSON/JSONB where clause processing when keys contain '::'.

package.json:12README.md:5-9

Dockerfile

containerizationlab environment definition

Defines a container based on node:20-bookworm-slim, copies application source, installs production dependencies, and starts the app on port 9100.

Dockerfile:1-13

eqst01.png

static assetbranding image

A binary PNG image served as a static asset, displayed as the EQST logo on the web interface.

app.js:1app.js:1

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-30951

Supported by supplied evidence

The application code contains the exact vulnerable pattern described in the README: a POST /api/users/search endpoint that passes user-controlled JSON filter keys directly to a Sequelize where clause on a JSON column. The README provides a PoC demonstrating SQL injection via a crafted key containing '::'.

app.js:420-440README.md:5-9README.md:55-75

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Node.js runtime and npm to install dependencies and start the application.README.md:27-29
Docker (optional) to build and run the containerized environment.README.md:33-35
The application must be running and accessible on port 9100.README.md:31

Evidence-described exercise path

Start the vulnerable application locally or via Docker.README.md:27-29README.md:33-35
Send a normal search request to POST /api/users/search with a filter object containing a 'name' key.README.md:43-51
Send a crafted request with a filter key containing '::' and SQL injection payload, e.g., 'name::text) or 1=1--'.README.md:55-65
Observe that all user rows are returned, confirming SQL injection.README.md:67-69

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The application is a self-contained vulnerability lab. It listens on a configurable port, serves static files, and queries a local SQLite database. There is no evidence of network connections to external systems, host filesystem access, credential theft, persistence mechanisms, or destructive behavior. The SQL injection is the intended exercise target.

app.js:1-511Dockerfile:1-13

Review boundaries

What the analysis did not establish

The eqst01.png file is binary and was not inspected.
The verify.js script referenced in package.json is not included in the evidence packet.
No Docker Compose or orchestration files are present; the lab topology is inferred from a single Dockerfile.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 1 binary file not inspected

Linked vulnerabilities

CVE-2026-30951