CVE-2019-9193

🗓️ 01 Apr 2019 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1223 Views🌐 WEB

CVE-2019-9193: PostgreSQL 9.3-11.2 allows execution of arbitrary code via "COPY TO/FROM PROGRAM"

Reporter	Title	Published	Views	Family All 47
zdt	PostgreSQL COPY FROM PROGRAM Command Execution Exploit	7 May 201900:00	–	zdt
zdt	PostgreSQL 9.3-11.7 - Remote Code Execution (Authenticated) Exploit	30 Mar 202200:00	–	zdt
zdt	PostgreSQL 9.6.1 - Remote Code Execution (Authenticated) Exploit	5 Apr 202300:00	–	zdt
GithubExploit	Exploit for OS Command Injection in Postgresql	29 Mar 202221:02	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Postgresql	6 Oct 202417:16	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Postgresql	21 Jan 202602:08	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Postgresql	1 Dec 202502:49	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Postgresql	6 Oct 202417:16	–	githubexploit
GithubExploit	SQLi	21 Apr 202609:36	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities (CVE-2018-1058, CVE-2018-10936, CVE-2019-9193)	27 May 202008:42	–	ibm

NVD

Node

Source	Link
security	www.security.netapp.com/advisory/ntap-20190502-0003/
paquier	www.paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/
trustwave	www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/
medium	www.medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5
packetstormsecurity	www.packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html
blog	www.blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/
packetstormsecurity	www.packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html

Parameter	Position	Path	Description	CWE
PROGRAM	path	/COPY_FROM_PROGRAM	PostgreSQL COPY FROM PROGRAM allows executing arbitrary OS commands as the database's operating system user when run by superuser or users in the pg_execute_server_program group.	CWE-78
PROGRAM	path	/COPY_TO_PROGRAM	PostgreSQL COPY TO PROGRAM can be used to execute OS commands via an external program, enabling command execution or data exfiltration through PROGRAM.	CWE-78

17 Jun 2026 02:43Current

7.4High risk

Vulners AI Score7.4

CVSS 37.2

CVSS 29

EPSS0.91655

SSVC