CVE-2024-1597
pgjdbc SQL Injection via line comment generation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
pgjdbc, el controlador JDBC de PostgreSQL, permite al atacante inyectar SQL si usa PreferQueryMode=SIMPLE. Tenga en cuenta que este no es el valor predeterminado. En el modo predeterminado no hay vulnerabilidad. Un comodín para un valor numérico debe ir precedido inmediatamente de un signo menos. Debe haber un segundo marcador de posición para un valor de cadena después del primer marcador de posición; ambos deben estar en la misma línea. Al construir un payload de cadena coincidente, el atacante puede inyectar SQL para alterar la consulta, evitando las protecciones que las consultas parametrizadas brindan contra los ataques de inyección SQL. Las versiones anteriores a 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9 y 42.2.8 se ven afectadas.
A flaw was found in the PostgreSQL JDBC Driver. A SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL that negates a parameter value.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-02-16 CVE Reserved
- 2024-02-19 CVE Published
- 2024-06-11 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (9)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2024-1597 | 2024-08-06 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2266523 | 2024-08-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Postgresql Search vendor "Postgresql" | Postgresql Jdbc Driver Search vendor "Postgresql" for product "Postgresql Jdbc Driver" | < 42.2.28 Search vendor "Postgresql" for product "Postgresql Jdbc Driver" and version " < 42.2.28" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Jdbc Driver Search vendor "Postgresql" for product "Postgresql Jdbc Driver" | >= 42.3.0 < 42.3.9 Search vendor "Postgresql" for product "Postgresql Jdbc Driver" and version " >= 42.3.0 < 42.3.9" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Jdbc Driver Search vendor "Postgresql" for product "Postgresql Jdbc Driver" | >= 42.4.0 < 42.4.4 Search vendor "Postgresql" for product "Postgresql Jdbc Driver" and version " >= 42.4.0 < 42.4.4" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Jdbc Driver Search vendor "Postgresql" for product "Postgresql Jdbc Driver" | >= 42.5.0 < 42.5.5 Search vendor "Postgresql" for product "Postgresql Jdbc Driver" and version " >= 42.5.0 < 42.5.5" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Jdbc Driver Search vendor "Postgresql" for product "Postgresql Jdbc Driver" | >= 42.6.0 < 42.6.1 Search vendor "Postgresql" for product "Postgresql Jdbc Driver" and version " >= 42.6.0 < 42.6.1" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Jdbc Driver Search vendor "Postgresql" for product "Postgresql Jdbc Driver" | >= 42.7.0 < 42.7.2 Search vendor "Postgresql" for product "Postgresql Jdbc Driver" and version " >= 42.7.0 < 42.7.2" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 40 Search vendor "Fedoraproject" for product "Fedora" and version "40" | - |
Affected
| ||||||