CVE-2023-25157— Unfiltered SQL Injection Vulnerabilities in Geoserver
Quick assessment
Affected
geoserver geoserver
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GeoServer是一个用 Java 编写的开源软件服务器。允许用户共享和编辑地理空间数据。 GeoServer 2.21.4之前、2.22.2之前版本存在安全漏洞，该漏洞源于 ` ` 存在滥用 问题。
Public Exploits 1
Nuclei · 1
CVE-2023-25157.yaml [template]
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-25157
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unfiltered SQL Injection Vulnerabilities in Geoserver
Source: CVE Program / CVE List V5
Vulnerability Description
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
GeoServer SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GeoServer是一个用 Java 编写的开源软件服务器。允许用户共享和编辑地理空间数据。 GeoServer 2.21.4之前、2.22.2之前版本存在安全漏洞，该漏洞源于 ``strEndsWith``、``strStartsWith`` 和 ``PropertyIsLike `` 存在滥用 问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2023-25157
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2023-25157 - GeoServer SQL Injection - PoC | https://github.com/win3zz/CVE-2023-25157 | POC Details |
| 2 | CVE-2023-25157 SQL injection vulnerability found in GeoServer | https://github.com/drfabiocastro/geoserver | POC Details |
| 3 | None | https://github.com/0x2458bughunt/CVE-2023-25157 | POC Details |
| 4 | GeoServer & GeoTools SQL Injection (CVE-2023-25157 & CVE-2023-25158) | https://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158 | POC Details |
| 5 | A script, written in golang. POC for CVE-2023-25157 | https://github.com/7imbitz/CVE-2023-25157-checker | POC Details |
| 6 | GeoServer OGC Filter SQL Injection Vulnerabilities | https://github.com/Rubikcuv5/CVE-2023-25157 | POC Details |
| 7 | Geoserver SQL Injection Exploit | https://github.com/dr-cable-tv/Geoserver-CVE-2023-25157 | POC Details |
| 8 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25157.yaml | POC Details |
| 9 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/GeoServer%20OGC%20Filter%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CVE-2023-25157.md | POC Details |
| 10 | https://github.com/vulhub/vulhub/blob/master/geoserver/CVE-2023-25157/README.md | POC Details | |
| 11 | None | https://github.com/custiya/geoserver-CVE-2023-25157 | POC Details |
| 12 | CVE-2023-25157 exp | https://github.com/charis3306/CVE-2023-25157 | POC Details |
| 13 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should enable the PostGIS DataStore preparedStatements setting and disable encode functions as a workaround. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/geoserver/geoserver-jsonarraycontains-sqli.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-25157
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-25157 (1)
Vendor Advisories for CVE-2023-25157 (1)
-
https://github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccf x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: geoserver
-
CVE-2025-21621
GeoServer Reflected Cross-Site Scripting (XSS) vulnerability -
CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External E -
CVE-2025-30220
GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE -
CVE-2025-30145
GeoServer has an Infinite Loop Vulnerability in Jiffle proce -
CVE-2025-27505
GeoServer Missing Authorization on REST API Index
Same vendor: geoserver
-
CVE-2025-58175
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerabi -
CVE-2025-52465
GeoServer has an arbitrary file write vulnerability in its M -
CVE-2025-27511
GeoServer DB2 DataStore Extension has a JNDI Vulnerability v -
CVE-2025-21621
GeoServer Reflected Cross-Site Scripting (XSS) vulnerability -
CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External E
Same weakness: CWE-89
-
CVE-2026-80381
Multiple vulnerabilities affect the Sniffer component as par -
CVE-2026-81932
Multiple vulnerabilities affect the Sniffer component as par -
CVE-2026-84209
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-16830
Security vulnerabilities have been found in IBM Verify Ident -
CVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protoco
V. Comments for CVE-2023-25157
No comments yet