<\/a>\n<\/div>\n
According to recent findings from Rapid7, threat actors who exploited a zero-day vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products in December 2024 likely also exploited a previously unknown SQL injection flaw in PostgreSQL.<\/p>\n
The vulnerability, tracked as CVE-2025-1094<\/a><\/strong> (CVSS score: 8.1), affects the PostgreSQL interactive tool psql.<\/p>\n “An attacker who can generate a SQL injection via CVE-2025-1094 can then achieve arbitrary code execution (ACE) by leveraging the interactive tool’s ability to run meta-commands,” security researcher Stephen Fewer said<\/a>.<\/p>\n The cybersecurity company further noted that it made the discovery as part of its investigation into CVE-2024-12356<\/a>, a recently patched security flaw in BeyondTrust software that allows for unauthenticated remote code execution.<\/p>\n Specifically, it found that “a successful exploit for CVE-2024-12356 had to include exploitation of CVE-2025-1094 in order to achieve remote code execution.”<\/p>\n In a coordinated disclosure, the maintainers of PostgreSQL released<\/a> an update to address the problem in the following versions:<\/p>\n The vulnerability stems from how PostgreSQL handles invalid UTF-8 characters, thus opening the door to a scenario where an attacker could exploit an SQL injection by making use of a shortcut command “!”<\/a>, which enables shell command execution.<\/p>\n “An attacker can leverage CVE-2025-1094 to perform this meta-command, thus controlling the operating system shell command that is executed,” Fewer said. “Alternatively, an attacker who can generate a SQL injection via CVE-2025-1094 can execute arbitrary attacker-controlled SQL statements.”<\/p>\n The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added<\/a> a security flaw impacting SimpleHelp remote support software (CVE-2024-57727<\/a>, CVSS score: 7.5) to the Known Exploited Vulnerabilities (KEV<\/a>) catalog, requiring federal agencies to apply the fixes by March 6, 2025.<\/p>\n <\/p>\n Zero-Day PostgreSQL Vulnerability Discovered \ue802February 14, 2025\ue804Ravie Lakshmanan Zero-Day \/ Vulnerability According to recent findings from Rapid7, threat actors who exploited a zero-day vulnerability in BeyondTrust Privileged Remote Access (PRA)…<\/p>\n","protected":false},"author":19,"featured_media":5096,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-5095","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/02\/PostgreSQL-zeroday.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/5095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=5095"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/5095\/revisions"}],"predecessor-version":[{"id":5097,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/5095\/revisions\/5097"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/5096"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=5095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=5095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=5095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Cybersecurity\"](\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjSsVzZMXE_YzNPyUX1Q0hPnz4RVdVaxj6x-DCGIcyLXfR1cRkaIHUcqr3ebiZ77EwqjgAYKfYlKZbT4dIs8ozRB2t2QK4JGEHtzzwS9f8ZRRhmzo_HJObKi8EaXfk_DpdXL4epfXXidevZocWqS0Zy6wZs_COxMIPDKdtVsWEibYa6EH7jiF8V6Kqf6qwv\/s728-rw-e365\/PostgreSQL-zeroday.png\")
<\/a><\/center><\/div>\n\n
<\/a><\/center><\/div>\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"