pgjdbc SQL Injection via line comment generation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: total
Summary
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- pgjdbc pgjdbc
fixed in 42.7.2; fixed in 42.6.1; fixed in 42.5.5; fixed in 42.4.4; fixed in 42.3.9; fixed in 42.2.28
- org.postgresql:postgresqlMaven
fixed in 42.2.28
- org.postgresql:postgresqlMaven
From 42.3.0 · fixed in 42.3.9
- org.postgresql:postgresqlMaven
From 42.4.0 · fixed in 42.4.4
- org.postgresql:postgresqlMaven
From 42.5.0 · fixed in 42.5.5
- org.postgresql:postgresqlMaven
From 42.6.0 · fixed in 42.6.1
- org.postgresql:postgresqlMaven
From 42.7.0 · fixed in 42.7.2