ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.

Affected: npm: @fecommunity/reactpress

## Summary

ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter *names* as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys.

## Impact

An unauthenticated remote attacker can perform blind SQL injection against the application database, potentially exfiltrating sensitive data (users, settings, API keys, article content, etc.).

## Affected endpoints (unauthenticated GET)

- `GET /api/article` - `GET /api/comment` - `GET /api/file` - `GET /api/page` - `GET /api/Knowledge`

## Affected code

Vulnerable pattern in `findAll()` methods, including but not limited to:

- `server/src/modules/article/article.service.ts` - `server/src/modules/comment/comment.service.ts` - `server/src/modules/file/file.service.ts` - `server/src/modules/page/page.service.ts` - `server/src/modules/knowledge/knowledge.service.ts`

## Remediation

- Whitelist allowed filter column names before interpolating into SQL. - Upgrade to `@fecommunity/reactpress` >= 3.7.0.

## Credit

Reported by lsr365400.