GHSA-jp74-mfrx-3qvh

## Summary Saltcorn's mobile-sync routes (`POST /sync/load_changes` and `POST /sync/deletes`) interpolate user-controlled values directly into SQL template literals without parameterization, type-casting, or sanitization. Any authenticated user (role_id ≥ 80, the default "user" role) who has read access to at least one table can inject arbitrary SQL, exfiltrate the entire database including admin password hashes, enumerate all table schemas, and—on a PostgreSQL-backed instance—execute write or DDL operations. ## Details ### Vulnerable code paths **Primary: `packages/server/routes/sync.js` — `getSyncRows()` function** ```js // Line 68 — maxLoadedId branch (no syncFrom) where data_tbl."${db.sqlsanitize(pkName)}" > ${syncInfo.maxLoadedId} // Line 100 — maxLoadedId branch (with syncFrom) and info_tbl.ref > ${syncInfo.maxLoadedId} ``` `syncInfo` is taken verbatim from `req.body.syncInfos[tableName]`. There is no `parseInt()`, `isFinite()`, or parameterized binding applied to `maxLoadedId` before it is embedded into the SQL string passed to `db.query()`. `db.sqlsanitize()` is used elsewhere in the same query to quote *identifiers* (table and column names) — a correct use — but is never applied to *values*, and would not prevent injection anyway because it only escapes double-quote characters. **Variant H1-V2: `packages/server/routes/sync.js` — `getDelRows()` function (lines 173–190)** ```js // Lines 182-183 — syncUntil and syncFrom come from req.body.syncTimestamp / syncFrom where alias.max < to_timestamp(${syncUntil.valueOf() / 1000.0}) and alias.max > to_timestamp(${syncFrom.valueOf() / 1000.0}) ``` `syncUntil = new Date(syncTimestamp)` where `syncTimestamp` comes from `req.body`. The resulting `.valueOf() / 1000.0` is still interpolated as a raw numeric expression. **Route handler: lines 113–170 (`/load_changes`)** ```js router.post( "/load_changes", loggedIn, // <-- only authentication check; no input validation error_catcher(async (req, r