Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| parse-community | parse-server | < 6.5.7, >= 7.0.0, < 7.1.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
HeavyGhost-le/POC_SQL_injection_in_Parse_Server_prior_6.5.7_-_7.1.0 ★ 2 · Oct 7, 2025
Advanced PostgreSQL database enumeration tool exploiting CVE-2024-39309 in Parse Server - Comprehensive SQL injection exploitation for security research
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | parse-server | < 6.5.7 | 6.5.7 | GHSA-c2hr-cqg6-8j6r |
| npm | parse-server | >= 7.0.0, < 7.1.0 | 7.1.0 | GHSA-c2hr-cqg6-8j6r |
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
- https://github.com/parse-community/parse-server/pull/9167
- https://github.com/parse-community/parse-server/pull/9168
- https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3
- https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b