Plixer Scrutinizer adminEditLang SQLi pg_cron RCE

Authenticated adminEditLang orderBy SQL injection schedules cron.scheduleindatabase COPY TO PROGRAM PostgreSQL/pgcron. """Plixer Scrutinizer adminEditLang ORDER BY SQLi to pgcron RCE.""" from future import annotations import re import time from urllib.parse import urlencode from kittysploit impor...

WS-2024-0013

A logical flaw in the pgcron extension allows low-privileged users with ownership over pgcron's job table or ability to change the value of cron.databasename to run arbitrary SQL queries as any user including superusers. This is also possible if superuser jobs are explicitly disabled. An attacker...