CVE-2016-8640 in pycsw
Summary
by MITRE
A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/25/2025
The CVE-2016-8640 vulnerability represents a critical SQL injection flaw within the pycsw software ecosystem, which serves as a Python-based Catalog Service for the Web implementation. This vulnerability affects multiple versions of pycsw including all releases before 2.0.2, 1.10.5, and 1.8.6, making it a widespread concern across the software's historical releases. The vulnerability stems from inadequate input validation and sanitization within the application's database query construction mechanisms, allowing malicious actors to inject arbitrary SQL commands through user-controllable parameters. The flaw specifically impacts the database interaction layer where user inputs are directly concatenated into SQL queries without proper escaping or parameterization, creating an exploitable attack surface that compromises the integrity of the underlying database infrastructure.
The technical exploitation of this vulnerability enables attackers to perform unauthorized data extraction from any database table that the pycsw database user account has access rights to, fundamentally undermining the confidentiality of the cataloged metadata. Beyond simple data read operations, the vulnerability permits more destructive actions on PostgreSQL databases, including the ability to execute update, insert, and delete operations against any table accessible to the database user. This capability transforms the vulnerability from a mere information disclosure issue into a full-fledged database manipulation threat that can lead to data corruption, unauthorized modifications, and potential system compromise. The vulnerability aligns with CWE-89, which categorizes SQL injection as a critical weakness in software applications, and maps to ATT&CK technique T1071.004 for application layer protocol manipulation. The flaw demonstrates poor input validation practices and highlights the importance of implementing proper database query parameterization techniques to prevent malicious SQL command injection.
The operational impact of CVE-2016-8640 extends far beyond simple data theft, as it provides attackers with the capability to manipulate the catalog service's underlying metadata repository. Organizations using affected pycsw versions face significant risks including unauthorized modification of geospatial metadata records, potential denial of service through database corruption, and the possibility of escalating privileges if the database user account has elevated permissions. The vulnerability affects any organization relying on pycsw for cataloging geospatial data, particularly government agencies, research institutions, and environmental organizations that depend on accurate metadata management. Attackers can leverage this vulnerability to modify catalog entries, inject malicious metadata, or even delete critical records, potentially disrupting data availability and integrity. The database modification capabilities particularly concerning for PostgreSQL deployments where the vulnerability enables full CRUD operations against database tables, making it a severe threat to data consistency and system reliability.
Mitigation strategies for CVE-2016-8640 primarily focus on immediate software patching to versions 2.0.2, 1.10.5, or 1.8.6 where the SQL injection vulnerabilities have been addressed through proper input validation and parameterized query implementation. Organizations should implement comprehensive database access controls, ensuring that pycsw database users have the minimal required permissions and that database accounts are not overly privileged. Network segmentation and firewall rules should be deployed to restrict access to the pycsw service and its underlying database, reducing the attack surface. Additionally, implementing web application firewalls and input validation mechanisms can provide additional layers of protection. Security monitoring should be enhanced to detect unusual database access patterns and potential exploitation attempts, while regular security audits should verify that no unauthorized modifications have occurred. The vulnerability serves as a critical reminder of the importance of secure coding practices and proper database interaction methodologies, particularly in applications handling sensitive metadata and catalog information, aligning with security frameworks that emphasize defense in depth and principle of least privilege access controls.