Description
NodeBB v4.3.0 在其搜索分类 API 端点（/api/v3/search/categories）中存在 SQL 注入漏洞。由于搜索查询参数未得到适当清理，攻击者可以通过注入基于布尔和基于 PostgreSQL 错误的数据负载，未经身份验证地远程执行恶意操作。这可能导致敏感数据泄露或数据库被破坏。
NodeBB /api/v3/search/categories SQL 注入漏洞（CVE-2025-50979）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-50979
https://github.com/advisories/GHSA-rfh2-8vxq-jqr8
https://cve.imfht.com/detail/CVE-2025-50979
https://www.chnhonker.com/2493.html
https://security.snyk.io/vuln/SNYK-JS-NODEBB-12224626
https://www.sentinelone.com/vulnerability-database/cve-2025-50979/
https://cybersecuritynews.com/nodebb-vulnerability/
https://cve.org/CVERecord?id=CVE-2025-50979