Sql Injection

2024-02-2007:34:50

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sql injection

postgresql

vulnerability

unescaped parameters

query

configuration option

attacker

exploit

payload

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

41.1%

JSON

org.postgresql, postgresql is vulnerable to Sql Injection. The vulnerability is caused due to not escaping user provided literal parameter values in SQL query when using configuration option PreferQueryMode=SIMPLE. An attacker can exploit this vulnerability to inject SQL to alter the query by crafting a specific payload , bypassing the protections that parameterized queries bring against SQL Injection attacks.

CPENameOperatorVersion
postgresql jdbc drivereq42.6.0
postgresql jdbc driverle42.2.27
postgresql jdbc driverle42.4.3
postgresql jdbc driverle42.7.1
postgresql jdbc driverle42.3.8
postgresql jdbc driverle42.5.4
java-postgresql-jdbc:3.19eq42.6.0-r1
java-postgresql-jdbc:edgeeq42.6.0-r1
java-postgresql-jdbc:edgeeq42.5.4-r0
java-postgresql-jdbc:edgeeq42.2.10-r0

Name	Operator	Version
postgresql jdbc driver	eq	42.6.0
postgresql jdbc driver	le	42.2.27
postgresql jdbc driver	le	42.4.3
postgresql jdbc driver	le	42.7.1
postgresql jdbc driver	le	42.3.8
postgresql jdbc driver	le	42.5.4
java-postgresql-jdbc:3.19	eq	42.6.0-r1
java-postgresql-jdbc:edge	eq	42.6.0-r1
java-postgresql-jdbc:edge	eq	42.5.4-r0
java-postgresql-jdbc:edge	eq	42.2.10-r0