CVE-2019-9193 PoC — PostgreSQL 操作系统命令注入漏洞

Source

https://github.com/wkjung0624/cve-2019-9193

Associated Vulnerability

Title:PostgreSQL 操作系统命令注入漏洞 (CVE-2019-9193)
Description:PostgreSQL是PostgreSQL组织的一套自由的对象关系型数据库管理系统。该系统支持大部分SQL标准并且提供了许多其他特性，例如外键、触发器、视图等。 PostgreSQL 9.3至11.2版本中的导入导出数据命令‘COPY TO/FROM PROGRAM’存在操作系统命令注入漏洞。攻击者可利用该漏洞获取数据库超级用户权限，从而执行任意系统命令。

Description

PostgreSQL Remote Code Executuon

Readme

# CVE-2019-9193

•	CVE-2019-9193 취약점
PostgreSQL은 “COPY TO / FROM PROGRAM” 의 기능을 통해 DB의 운영체제 내에서 임의의 코드를 실행할 수 있는 취약점
공격 vector는 “SuperUser”와 “pg_execute_server_program” 그룹의 User가 해당

File Snapshot


 [4.0K]  /data/pocs/4158c84ee0bd984049821764ea33cdeb469f07da
├── [2.1K]  portgres_rce.py
└── [ 282]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!