PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Sensing and blocking JavaScript SQL injection attacks

aikido.dev | blog | #sql-injection | #web-security | #waf | #postgresql | #javascript | #nodejs | #orm | #typeorm | #mysql | #sequelize | #aikido-firewall
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

JavaScript apps on MySQL or PostgreSQL remain exposed to SQL injection, and ORMs like Sequelize and TypeORM or WAFs don't fully close the gap. Real examples show what vulnerable code looks like.
Published
Collected

Related coverage

blog · aikido.dev
Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained
Prisma queries accept operator objects that attackers can abuse, so crafted input can bypass password checks even on PostgreSQL. The post demonstrates operator injection exploits and defenses.
blog · hackerone.com
The Role of ORMs in Modern Web Frameworks
ORMs bridge object-oriented code and relational databases, automating CRUD and reducing SQL injection risk; a tour of Django ORM, ActiveRecord, Entity Framework, and TypeORM trade-offs.
blog · netspi.com
Escape NodeJS Sandboxes
Lars Sorenson explores NodeJS sandbox escapes, walking through reverse shell techniques and methods to regain require functionality when sandboxes block module imports, based on interpreter internals.
blog · aikido.dev
Aikido funds Node.js security
Aikido has joined OpenJS’s Security Stewardship Program as an inaugural partner, funding a pool split evenly between bug bounties and maintainer support, starting with Node.js.
blog · aikido.dev
Top 10 JavaScript Security Vulnerabilities in Modern Web Apps
Surveys the top ten JavaScript vulnerabilities across frontend and Node.js—from XSS to vulnerable dependencies—with real incidents like an old jQuery XSS CVE and mitigation steps for each.
blog · aikido.dev
NPM Security Audit: The Missing Layer Your Team Still Need
Your biggest npm risks come from packages you didn't write; the article explains why built-in npm audit falls short and what a proper security audit layer should cover across the dependency lifecycle.
Back