EQSTLab/CVE-2026-34220

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a complete, runnable Node.js application (app.js) that intentionally includes a vulnerable custom MikroORM type (JsonOrRawType) and exposes API endpoints. The README.md provides explicit curl commands to send a malicious JSON payload containing a `__raw` property with attacker-controlled SQL, which the application will execute, exfiltrating data from an unrelated table. This constitutes a fully functional exploit environment and proof-of-concept.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept (PoC) for CVE-2026-34220, a SQL injection vulnerability in MikroORM. The code sets up a vulnerable Express application with a custom column type that passes attacker-controlled objects containing a `__raw` property directly into SQL queries. The README documents the vulnerability and provides a curl command to trigger it. No backdoor, trojan, or deceptive behavior targeting the person running the PoC was observed. The application's behavior is consistent with demonstrating the described SQL injection vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesJavaScriptMarkdown
Target softwareMikroORM
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes a complete, runnable vulnerable application and explicit instructions (curl command) to trigger the SQL injection vulnerability, resulting in unauthorized data exfiltration. This is code intended to exercise a vulnerability, meeting the definition of an exploit.

README.md:37-64app.js:1-379

Requirements

  • A running instance of the vulnerable application, which can be built and started using the provided Dockerfile and instructions.README.md:30-33Dockerfile:1-12

Observed behavior

  • The application defines a custom MikroORM type `JsonOrRawType` that passes objects with a `__raw` property directly to the database without sanitization.app.js:11-17
  • The `/api/posts` endpoint accepts user-supplied JSON and creates a database entity with the `content` field, which is of the vulnerable custom type.app.js:300-316
  • The README provides a curl command that sends a JSON payload with `"content": { "__raw": true, "sql": "(SELECT group_concat(name || ': ' || salary, ' / ') FROM salaries)" }`, causing the SQL subquery to be executed and its result stored in the post content.README.md:43-53
  • The application seeds a `salaries` table with sensitive data, including a flag string, which the exploit exfiltrates.app.js:54-71
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Demonstration
Custom type JsonOrRawType in app.js passes objects with '__raw' property directly to SQL queriesThis is the core of the demonstrated CVE-2026-34220 SQL injection vulnerability, not a backdoor.app.js:11-17
Sensitive Data Seed
FLAG = EQST{r4w_qu3ry_fr4gm3nt_1nj3ct10n}A flag string is seeded into the database as part of the PoC scenario to demonstrate data exfiltration via SQL injection.app.js:70
Poc Instruction
curl command in README.md sends a JSON payload with __raw and sql properties to trigger SQL injectionThis is the documented PoC trigger, not a backdoor command.README.md:43-53
Review boundaries

What the analysis did not establish

  • One file (likely a binary or non-text asset) was omitted from the evidence; its absence does not affect the classification of the provided text files as an exploit.
  • The evidence packet reports complete_artifact_coverage as false, but all readable selected text files are fully included.
  • One file (package-lock.json or similar) was omitted from the text evidence; its content was not reviewed, but it is typically a dependency lock file and unlikely to contain backdoor logic.
  • Binary files were not present in the evidence.
  • The review is limited to the supplied text content and does not include dynamic analysis or execution of the code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2026-34220Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Node.js web application using Express and MikroORM 6.6.9 with SQLite, designed as a CVE playground for demonstrating SQL injection via a custom ORM type.

Dockerfile:1-12app.js:1-379package.json:1-15README.md:1-76

Lab assessment

Vulnerability lab

The README explicitly describes a CVE-2026-43220 SQL Injection PoC, the package.json is named 'CVE-Playground-CVE-2026-34220', and app.js contains a custom JsonOrRawType designed to accept raw SQL fragments, with comments marking vulnerable points.

README.md:1-5package.json:2app.js:8app.js:36
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Node.js Express Application

web servervulnerable target

Serves a board with write/edit endpoints. Uses a custom MikroORM type (JsonOrRawType) that passes user-supplied objects with a '__raw' property directly into SQL queries, enabling SQL injection.

app.js:1-379Dockerfile:1-12

MikroORM 6.6.9

ORM libraryvulnerable dependency

The ORM layer that processes entities and generates SQL. The custom type bypasses sanitization when a value contains '__raw', allowing raw SQL fragments to be injected.

package.json:9-10app.js:8-28

SQLite Database

data storetarget of exfiltration

An in-memory SQLite database seeded with a 'salaries' table containing a flag. The SQL injection targets this table to exfiltrate sensitive data.

app.js:50-67app.js:90
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-34220

Insufficient evidence

The packet's unit_cve_ids contains only CVE-2026-34220, but the README describes CVE-2026-43220 and the package.json name references CVE-2026-34220. No evidence in the supplied files describes the specific vulnerability, affected versions, or impact for CVE-2026-34220. The visible code and README are entirely about a SQL injection via a custom type, which the README associates with CVE-2026-43220. The relationship between the two CVE identifiers is unresolved.

README.md:1-5package.json:2
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:22-24
  • The application must be built and started, exposing port 3000.README.md:22-24Dockerfile:10
  • An attacker must send a POST request to /write (or /api/posts) with a JSON body containing a '__raw' property in the 'content' field.README.md:30-40app.js:8-28

Evidence-described exercise path

  1. Build the Docker image.README.md:22
  2. Run the container with port mapping.README.md:23
  3. Send a POST request with a malicious payload containing '__raw' to inject SQL.README.md:30-40
  4. Verify the response indicates success.README.md:42-44
  5. Confirm that sensitive data from the 'salaries' table appears in the post content.README.md:47-51
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the containerized lab environment. The application listens on port 3000, serves a web board, and accepts user input that triggers the demonstrated SQL injection. There is no evidence of host escape, external connectivity, credential theft, persistence, or destructive actions beyond the intended lab target.

Dockerfile:1-12app.js:1-379README.md:22-24
Review boundaries

What the analysis did not establish

  • The packet contains two CVE identifiers (CVE-2026-34220 in package.json and CVE-2026-43220 in README) but only CVE-2026-34220 is in unit_cve_ids. The relationship between them is unresolved.
  • No Compose file is present; the environment is described only by a Dockerfile and README instructions.
  • The Dockerfile uses node:18-alpine without a digest, so the exact base image is not pinned.
  • The package-lock.json is large and was not inspected for supply-chain risks beyond the declared dependencies.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1