Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-7qpv-r5mr-78m4

Опубликовано: 30 июл. 2026
Источник: github
Github: Не прошло ревью

Описание

SQL injection in ext-pgsql via E'...' backslash breakout

php_pgsql_convert() is used to convert and escape user-provided parameters in pg_insert(), pg_update(), pg_select(), and pg_delete(). It does so using PQescapeStringConn() and then wraps the result in an escape string constant, E'...' (via php_pgsql_add_quotes()).

https://github.com/php/php-src/blob/cbc0489126a7682796aad1e5fb4e51de74af162c/ext/pgsql/pgsql.c#L4751-L4757

With standard_conforming_strings = on (the default since PostgreSQL 9.1), PQescapeStringConn() does not correctly escape values for the escape string constant E'...', as it does not escape \ under this configuration. When PQescapeStringConn() escapes ' as '', an attacker can trivially terminate the string by escaping the first single quote.

$result = pg_select($db, 'user', ['name' => "zzz\\' OR 1=1 --"]); // SELECT * FROM "user" WHERE "name"='zzz\'' OR 1=1 --'; var_dump($result); // returned all rows

Note that the doubled \\ is a PHP escape sequence and that the \ appears only once in the parameter. Also note that pg_select() escapes the ' by doubling it but does not escape the \. Consequently, the first of the two ' characters is escaped (meaning that it represents a literal '), while the second terminates the string. Everything after that is interpreted as part of the query.

The solution changes php_pgsql_convert() to wrap parameters in non-escaping string constants instead.

Пакеты

Наименование

php

php
Затронутые версииВерсия исправления

>=8.2.0, <8.2.33

8.2.33

Наименование

php

php
Затронутые версииВерсия исправления

>=8.3.0, <8.3.33

8.3.33

Наименование

php

php
Затронутые версииВерсия исправления

>=8.4.0, <8.4.24

8.4.24

Наименование

php

php
Затронутые версииВерсия исправления

>=8.5.0, <8.5.9

8.5.9

EPSS

Процентиль: 38%
0.00468
Низкий

Дефекты

CWE-89

Связанные уязвимости

CVSS3: 9.8
ubuntu
12 дней назад

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

CVSS3: 7.4
redhat
12 дней назад

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

CVSS3: 9.8
nvd
12 дней назад

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

CVSS3: 9.8
msrc
4 дня назад

SQL injection in ext-pgsql via E'...' backslash breakout

CVSS3: 9.8
debian
12 дней назад

Improper escaping of backslashes in attacker-provided parameters would ...

EPSS

Процентиль: 38%
0.00468
Низкий

Дефекты

CWE-89