Description
When pg_jobmon is installed and part_config.jobmon = true, multiple exception handlers in pg_partman build a jobmon add_job call using format('SELECT %I.add_job(''PARTMAN : %s'')', v_jobmon_schema, p_parent_table). The %s substitution places p_parent_table verbatim inside a SQL string literal, which a single quote in p_parent_table terminates — allowing arbitrary SQL after the closing ').
Vulnerability Information
- Product / Framework: PostgreSQL pg_partman
- Vendor Domain: www.postgresql.org
- Vulnerability Type: SQL Injection
- CVE Details: View Full CVE Details →