QwikSec

Security Database

CVE

CWE

Training

CVE-2012-1618

Published: Oct 6, 2012

Modified: Aug 6, 2024

PUBLISHED

Description

Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

[oss-security] 20120330 postgresql-jdbc 8.1 SQL injection with postgresql server 9.1

mailing-list

x_refsource_MLIST

[oss-security] 20120402 Re: [JDBC] CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters

mailing-list

x_refsource_MLIST

https://bugzilla.novell.com/show_bug.cgi?id=754273

x_refsource_MISC

[oss-security] 20120404 Re: CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters

mailing-list

x_refsource_MLIST

vdb-entry

x_refsource_OSVDB

[opensuse-security] 20120325 SQL injection attack possible when connecting to PostgreSQL 9.1 with version 8.1 JDBC driver

mailing-list

x_refsource_MLIST

[oss-security] 20120404 Re: Re: [JDBC] CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters

mailing-list

x_refsource_MLIST

[oss-security] 20120404 Re: Re: [pgsql-security] postgresql-jdbc 8.1 SQL injection with postgresql server 9.1

mailing-list

x_refsource_MLIST

[oss-security] 20120330 CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters

mailing-list

x_refsource_MLIST

[oss-security] 20120404 Re: CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters

mailing-list

x_refsource_MLIST

[oss-security] 20120331 SQL injection attack possible when connecting to PostgreSQL 9.1 with version 8.1 JDBC driver

mailing-list

x_refsource_MLIST

20120325 SQL injection attack possible when connecting to PostgreSQL 9.1 with version 8.1 JDBC driver

mailing-list

x_refsource_BUGTRAQ

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.