CVE-2024-1597— pgjdbc SQL Injection via line comment generation

pgjdbc SQL Injection via line comment generation

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

PostgreSQL JDBC Driver 安全漏洞

PostgreSQL JDBC Driver是一个用 Pure Java（Type 4）编写的开源 JDBC 驱动程序，用于 PostgreSQL 本地网络协议中进行通信。 PostgreSQL JDBC Driver存在安全漏洞，该漏洞源于存在SQL注入漏洞。受影响的产品和版本：pgjdbc 42.2.28之前版本，42.3.9之前版本，42.4.4之前版本，42.5.5之前版本，42.6.1之前版本，42.7.2之前版本。

N/A

N/A