vendor:
PostgreSQL
by:
b4keSn4ke
8.8
CVSS
HIGH
Remote Code Execution (RCE)
78
CWE
Product Name: PostgreSQL
Affected Version From: 9.3
Affected Version To: 11.7
Patch Exists: YES
Related CWE: CVE-2019–9193
CPE: a:postgresql:postgresql
Platforms Tested: Linux x86-64 - Debian 4.19
2022
PostgreSQL 9.3-11.7 – Remote Code Execution (RCE) (Authenticated)
This exploit allows an authenticated user to execute arbitrary code on a vulnerable PostgreSQL server. The exploit uses a base64 encoded payload which is passed to the PostgreSQL server via a SELECT statement. The payload is then decoded and executed on the server.
Mitigation:
Ensure that all users have the least privileges necessary to perform their tasks. Additionally, ensure that all PostgreSQL servers are running the latest version of the software.