A critical SQL injection vulnerability in the JawherKl node-api-postgres library enables unauthenticated attackers to perform unauthorized database exfiltration and account takeover.

The vulnerability exists within the models/user.js file where the User.getAll function improperly sanitizes the sort argument before concatenating it into a SQL query. This flaw allows an unauthenticated attacker to inject malicious SQL commands, leading to the exposure of sensitive user data including bcrypt password hashes.

Successful exploitation of this vulnerability permits unauthorized access to the application database. An attacker can extract user credentials, session information, and administrative data, which directly facilitates full system compromise and account takeover. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to severe reputational damage and regulatory non-compliance.

Immediate Action: Since no official vendor patch is currently available, developers must manually implement an allowlist for the sort parameter in models/user.js to restrict input to predefined, safe fields.

Proactive Monitoring: Security teams should review application access logs for anomalous GET requests to the /users endpoint that contain SQL syntax or unexpected characters in the sort parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules configured to detect and block SQL injection patterns, specifically targeting the sort parameter in HTTP requests.

Public Exploit Available: Yes, a public proof-of-concept is documented in the referenced security research write-up on HackMD.

The severity of this SQL injection vulnerability necessitates immediate attention from engineering teams. Because the vendor has not provided an official fix, developers must apply the recommended code-level mitigation by implementing strict input sanitization and parameter allowlisting. Failure to address this flaw leaves the application exposed to database exfiltration and potential administrative compromise by unauthenticated remote actors.