PostgreSQL up to 17.2 quoting syntax

Summaryinfo

A vulnerability has been found in PostgreSQL up to 13.18/14.15/15.10/16.6/17.2 and classified as critical. This impacts the function PQescapeLiteral/PQescapeIdentifier/PQescapeString/PQescapeStringConn. This manipulation causes quoting syntax. This vulnerability is handled as CVE-2025-1094. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in PostgreSQL up to 13.18/14.15/15.10/16.6/17.2. It has been declared as critical. Affected by this vulnerability is the function PQescapeLiteral/PQescapeIdentifier/PQescapeString/PQescapeStringConn. The manipulation with an unknown input leads to a quoting syntax vulnerability. The CWE definition for the vulnerability is CWE-149. Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

It is possible to read the advisory at postgresql.org. This vulnerability is known as CVE-2025-1094 since 02/06/2025. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 216248 (Debian dla-4052 : libecpg-compat3 - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 13.19, 14.16, 15.11, 16.7 or 17.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (967), Tenable (216248) and CERT Bund (WID-SEC-2025-0372). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Dell NetWorker
• Dell Avamar
• Qlik Sense
• Open Source PostgreSQL
• Progress Software WS_FTP
• IBM QRadar SIEM
• Broadcom Brocade SANnav

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 13.0
• 13.1
• 13.2
• 13.3
• 13.4
• 13.5
• 13.6
• 13.7
• 13.8
• 13.9
• 13.10
• 13.11
• 13.12
• 13.13
• 13.14
• 13.15
• 13.16
• 13.17
• 13.18
• 14.0
• 14.1
• 14.2
• 14.3
• 14.4
• 14.5
• 14.6
• 14.7
• 14.8
• 14.9
• 14.10
• 14.11
• 14.12
• 14.13
• 14.14
• 14.15
• 15.0
• 15.1
• 15.2
• 15.3
• 15.4
• 15.5
• 15.6
• 15.7
• 15.8
• 15.9
• 15.10
• 16.0
• 16.1
• 16.2
• 16.3
• 16.4
• 16.5
• 16.6
• 17.0
• 17.1
• 17.2

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion