CVE-2026-25993 — EverShop Second-Order SQL Injection Lab

Prerequisites

• Docker Engine 24+ with Docker Compose v2+
• 2 GB free RAM

Deploy

cd EverShop-Lab/
docker compose up

Wait ~2 minutes for first build (clones EverShop v2.1.0, compiles, runs migrations, seeds data).

App will be available at http://localhost:3000.

Credentials

Stop / Reset

# Stop the lab (keep data)
docker compose down

# Stop and delete all data (fresh start next time)
docker compose down -v

# Rebuild from scratch
docker compose down -v
docker compose up -d --build

The Vulnerability

CVE-2026-25993 is a second-order SQL injection in EverShop's category URL rewrite processing. The url_key field only validates ^\S+$ (no whitespace), allowing SQL metacharacters. When a category is updated, an event subscriber builds raw SQL via string concatenation, executing the stored url_key in the database.

Goal

Dump the entire database. No flags. Your objective:

1. Extract the PostgreSQL version string (proof of injection)
2. Enumerate all database tables
3. Extract row data from key tables (admin_user, customer, product, etc.)

Hint

The url_key field on categories rejects spaces but accepts ' and ||. When a category is updated, an event subscriber concatenates that url_key into a raw SQL REPLACE() call. Create a parent category, add a child under it, then update the parent's url_key — the result lands in the child's url_rewrite entry after ~15 seconds.

References

• CVE-2026-25993
• GitHub Advisory GHSA-3h84-9rhc-j2ch
• EverShop Repository