High severity · published Feb 13, 2025
CVE-2025-1094
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
8.1
CVSS
90%
EPSS
No
On KEV
Description
Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)90.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
PostgreSQL · PostgreSQL
17 before 17.3; 16 before 16.7; 15 before 15.11; 14 before 14.16; before 13.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1094
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1094
www.postgresql.org
https://www.postgresql.org/support/security/CVE-2025-1094/
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/02/16/3
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/02/20/1
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/02/msg00015.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/02/msg00024.html
security.netapp.com
https://security.netapp.com/advisory/ntap-20250221-0010/
More from PostgreSQL
9.8
CVE-2024-24213
Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query
9.8
CVE-2015-0244
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message,…
9.8
CVE-2015-3166
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call…
9.8
CVE-2019-10211
Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory
9.8
CVE-2018-16850
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER