CVE-2019-9193

EN GenPostgresRCEExploit 是一个 PoC 工具，旨在利用特定版本 PostgreSQL（9.3 - 11.7）中经过身份验证的远程代码执行（RCE）漏洞。它允许已认证用户在存在 CVE-2019-9193 漏洞的 PostgreSQL 数据库服务器上执行系统命令。 功能特性 RCE 漏洞利用 ：通过已认证的 PostgreSQL 会话执行系统命令。 版本检查 ：验证目标 PostgreSQL 服务器的版本，以确认是否存在该漏洞。 命令执行 ：如果服务器存在漏洞，则允许在服务器上执行自定义命令。 自动表管理 ：自动创建和删除用于命令执行的临时表，无需手动干预。 环境...

CVE-2019-9193byVulHub

CVE-2019-9193byVulHub PostgreSQL 管理员权限下的任意命令执行 CVE-2019-9193 描述 PostgreSQL 是一个强大的开源关系数据库管理系统。存在于 9.3 到 11 版本中的一个漏洞允许管理员或拥有 COPY TO/FROM PROGRAM 权限的用户在系统上执行任意命令。 参考链接： GitHub - Vulhub - PostgreSQL CVE-2019-9193 Greenwolf Security - 在 PostgreSQL 9.3 及更新版本中通过身份验证的任意命令执行 环境配置 Docker Compose 文件...

CVE-2019-9193-Postgresql-RCE

用法：CVE-2019-9193.py -h -i IP -p PORT -d DATABASE -c COMMAND -t TIMEOUT -U USER -P PASSWORD 示例：python3 CVE-2019-9193.py -i 127.0.0.1 -p 5432 -U postgres -c 'id' 示例 2：python3 CVE-2019-9193.py -h localhost -p 5432 -U postgres -c 'id' 输出： + 正在连接位于 127.0.0.1:5432 的 PostgreSQL 数据库 + 数据库连接已建立 + 正在检查...

Exploit for OS Command Injection in Postgresql

usage: CVE-2019-9193.py -h -i IP -p PORT -d DATABASE...

Exploit for OS Command Injection in Postgresql

EN GenPostgresRCEExploit is a PoC tool designed to exploit...

PostgreSQL 9.6.1 Remote Code Execution

Exploit Title: PostgreSQL 9.6.1 - Remote Code Execution RCE Authenticated Date: 2023-02-01 Exploit Author: Paulo Trindade @paulotrindadec, Bruno Stabelini @Bruno Stabelini, Diego Farias @fulcrum and Weslley Shaimon Github: https://github.com/paulotrindadec/CVE-2019-9193 Version: PostgreSQL 9.6.1 ...

PostgreSQL 9.6.1 - Remote Code Execution (Authenticated) Exploit

Exploit Title: PostgreSQL 9.6.1 - Remote Code Execution RCE Authenticated Exploit Author: Paulo Trindade @paulotrindadec, Bruno Stabelini @Bruno Stabelini, Diego Farias @fulcrum and Weslley Shaimon Github: https://github.com/paulotrindadec/CVE-2019-9193 Version: PostgreSQL 9.6.1 on...

PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: PostgreSQL 9.6.1 - Remote Code Execution RCE Authenticated Date: 2023-02-01 Exploit Author: Paulo Trindade @paulotrindadec, Bruno Stabelini @Bruno Stabelini, Diego Farias @fulcrum and Weslley Shaimon Github: https://github.com/paulotrindadec/CVE-2019-9193 Version: PostgreSQL 9.6.1 ...

PostgreSQL 11.7 Remote Code Execution

Exploit Title: PostgreSQL 9.3-11.7 - Remote Code Execution RCE Authenticated Date: 2022-03-29 Exploit Author: b4keSn4ke Github: https://github.com/b4keSn4ke Vendor Homepage: https://www.postgresql.org/ Software Link: https://www.postgresql.org/download/linux/debian/ Version: 9.3 - 11.7 Tested on:...

PostgreSQL 9.3-11.7 - Remote Code Execution (Authenticated) Exploit

Exploit Title: PostgreSQL 9.3-11.7 - Remote Code Execution RCE Authenticated Exploit Author: b4keSn4ke Github: https://github.com/b4keSn4ke Vendor Homepage: https://www.postgresql.org/ Software Link: https://www.postgresql.org/download/linux/debian/ Version: 9.3 - 11.7 Tested on: Linux x86-64 -...

Exploit for OS Command Injection in Postgresql

CVE-2019–9193 - PostgreSQL 9.3-12.3 Authenticated Remote Code...

PGMiner, Innovative Monero-Mining Botnet, Surprises Researchers

An innovative Linux-based cryptocurrency mining botnet has been uncovered, which exploits a disputed PostgreSQL remote code-execution RCE vulnerability to compromise database servers. The malware is unusual and completely novel in a host of ways, researchers said. According to researchers at Palo...

CVE-2019-9193 PostgreSQL allows OS level commands via COPY SQL function

An OS command injection vulnerability in FortiAnalyzer, FortiAuthenticator and FortiManager may allow a privileged system administrator to run OS level commands on the system via injecting commands in SQL queries...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities (CVE-2018-1058, CVE-2018-10936, CVE-2019-9193)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerabilities 3 issues for Postgresql: 1 for a flaw in the searchpath setting2, 1 for a failure to check the host name if a host name verifier was not provided to the driver and...

Security Bulletin: IBM Security Information Queue uses database components with known vulnerabilities (CVE-2016-3506, CVE-2018-1058, CVE-2018-10936, CVE-2019-9193)

Summary IBM Security Information Queue ISIQ relies on older Oracle JDBC and PostgreSQL JAR files that have known vulnerabilities. As of v1.0.5, ISIQ switched to newer, secure versions of the JAR files. Vulnerability Details CVEID: CVE-2016-3506 DESCRIPTION: Unspecified vulnerability in the JDBC...

PostgreSQL Remote Code Execution (CVE-2019-9193)

A remote code execution vulnerability exists in PostgreSQL. Successful exploitation of this vulnerability could result in arbitrary code execution on the victim machine...

CVE-2019-9193

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pgexecuteserverprogram' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary...

CVE-2019-9193

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pgexecuteserverprogram' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary...

CVE-2019-9193

The CVE-2019-9193 entry concerns PostgreSQL 9.3–11.2 where the COPY TO/FROM PROGRAM functionality allows superusers or members of the pg_execute_server_program role to run arbitrary OS commands as the database server OS user. This behavior is enabled by default and can enable command execution on...