CVE-2025–1094: PostgreSQL Injection Vulnerability Exploit

Overview

CVE-2025–1094 is a high-severity SQL injection vulnerability affecting multiple versions of PostgreSQL. This flaw is caused by improper neutralization of quoting syntax within PostgreSQL’s escaping functions, which can be leveraged by attackers to execute arbitrary SQL commands.

Affected PostgreSQL Versions

• PostgreSQL 17 (before v17.3)
• PostgreSQL 16 (before v16.7)
• PostgreSQL 15 (before v15.11)
• PostgreSQL 14 (before v14.16)
• PostgreSQL 13 (before v13.19)

Exploited Functions

The vulnerability exists in the following PostgreSQL escaping functions:

• PQescapeLiteral()
• PQescapeIdentifier()
• PQescapeString()
• PQescapeStringConn()

These functions are used to sanitize user inputs for SQL queries. However, due to improper handling of certain character encodings, attackers can bypass security mechanisms and execute SQL injection attacks.

Exploit Prerequisites