PT-2024-25952 · Yvan Dotet · Postgresql Query Deluxe

Published 2024-05-06 · Updated 2024-07-03 · CVE-2024-34532

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yvan Dotet PostgreSQL Query Deluxe module versions 17.x before 17.0.0.4

Description A SQL injection issue allows a remote attacker to gain privileges via the query parameter to models/querydeluxe.py:QueryDeluxe::get result from query. This enables the attacker to potentially execute malicious SQL code.

Recommendations For versions 17.x before 17.0.0.4, update to version 17.0.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the QueryDeluxe module or limiting the input allowed for the query parameter until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-34532

Affected Products

Postgresql Query Deluxe

References · 4

• 🔥 https://github.com/luvsn/OdZoo/tree/main/exploits/query_deluxe · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34532 · Security Note
• https://t.me/cvenotify/79405 · Telegram Post
• https://twitter.com/CVEnew/status/1787926453717508579 · Twitter Post