eqstlab/cve-2026-0603Hibernate ORM Second-Order SQL Injection
★ CVE-2026-0603 Hibernate SQL Injection PoC ★
https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f
CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM, a widely used Java ORM framework.
When a user-supplied string primary key containing a malicious SQL payload is used in a bulk DELETE or UPDATE operation, Hibernate inserts the value directly into the WHERE clause without sanitization, causing unintended mass deletion or modification of database records.
| Category | Version |
|---|
| Vulnerable | Hibernate ORM 5.2.8 ≤ version ≤ 5.6.15 |
| Patched | No official patch (5.6.x EOL) |
docker build -t cve-2026-0603-hibernate-vuln .
docker run --rm -it -p 8080:8080 --name hibernate-vuln cve-2026-0603-hibernate-vuln
After starting the vulnerable environment, follow the steps below to reproduce the attack.
username: ' or '1' = '1
Click the update or delete button on the registered account.
Verify that the DELETE or UPDATE query was applied to all rows, not just the registered account. For DELETE, all records across both tables are removed. For UPDATE, all records are modified with the attacker-supplied values.
InlineIdsOrClauseBulkIdStrategy setting from application.ymlInlineIdsOrClauseBulkIdStrategy must be used, apply strict whitelist-based input validation on any user-supplied primary key values to reject SQL control characters