Description
Several functions listed below build a dynamic SQL statement that interpolates the part_config.time_dncoder value raw (%s, not %I) into an EXECUTE format('SELECT %s(%L)', …) call. The time_dncoder column is plain text with no CHECK constraint and no INSERT/UPDATE trigger, so any role holding the documented partman_user grants (INSERT/UPDATE on partman.part_config) can store an arbitrary SQL string there rather than a function name. Because the value is spliced verbatim instead of being quoted as an identifier, a crafted multi-statement payload such as benign_decoder(now()); ALTER ROLE attacker SUPERUSER; SELECT benign_decoder is executed as written.
Vulnerability Information
- Product / Framework: PostgreSQL pg_partman
- Vendor Domain: www.postgresql.org
- Vulnerability Type: SQL Injection
- CVE Details: View Full CVE Details →