Zero-day SQL Injection Vulnerability In PostgreSQL

Dedicated to providing insightful articles on cybersecurity threat intelligence, aimed at empowering individuals and organizations to navigate the digital landscape safely.

Vulnerability Information

Vulnerability ID: CVE-2025-1094

CVSS Score (3.1): 8.1

Severity Level: High

Affected Versions: All PostgreSQL versions before 17.3, 16.7, 15.11, 14.16, 13.19 are affected.

CVE-2025-1094 was discovered during the research of the vulnerability CVE-2024-12356 - which allows an unauthenticated attacker to execute remote code on BeyondTrust products. Researchers found that successfully exploiting CVE-2025-1094 is a stepping stone to exploiting CVE-2024-12356. Although BeyondTrust released a patch for CVE-2024-12356 in December 2024, the vulnerability in PostgreSQL remained unaddressed until researchers at Rapid7 discovered it.

Originating from PostgreSQL's improper handling of quoting syntax in libpq library functions, including:

PQescapeLiteral()

PQescapeIdentifier()

PQescapeString()

PQescapeStringConn()

Although these functions are designed to escape special characters and prevent SQL Injection risks in psql (PostgreSQL's interactive terminal), if developers misuse these functions when building SQL queries in psql, it can still lead to code injection, especially when combined with psql's handling of invalid UTF-8 strings.

Similarly, if quoting syntax is not handled correctly in PostgreSQL's command-line utility programs, SQL Injection can still be exploited when the client_encoding parameter is set to BIG5 and the server_encoding parameter is set to EUC_TW or MULE_INTERNAL.

Research also shows that hackers can take control of the entire system if they successfully exploit CVE-2025-1094. By exploiting the ability to run meta-commands of the interactive tool, which allows extending the tool's functionality and providing additional operations like executing commands with the exclamation mark ! in psql, hackers can execute shell commands with operating system privileges, leading to arbitrary code execution and system control.

PostgreSQL users need to update to version 17.3, 16.7, 15.11, 14.16, 13.19, or newer versions to receive the patch for this vulnerability.

Zero-day SQL Injection Vulnerability In PostgreSQL

Comments

Newsletters-eng

More from this blog

MedusaHVNC: "Màn hình Windows vô hình" đang giúp tin tặc qua mặt mọi ánh mắt giám sát

MedusaHVNC: "Invisible Windows screen" is helping hackers bypass all surveillance eyes

SourTrade: Chiến dịch biến JavaScript thành dây chuyền sản xuất mã độc

SourTrade: Campaign to turn JavaScript into a malware production line

Bạn Kết Nối Wi-Fi Khách Sạn, Kẻ Tấn Công Đã Vào Tài Khoản Microsoft 365 — Mà Bạn Không Nhấp Gì Cả

Vulnerability Information

References

Command Palette

Comments

Newsletters-eng

More from this blog

Vulnerability Information

References