Description
inherit_template_properties() constructs an ALTER TABLE … ADD PRIMARY KEY (…)statement by **manually** double-quoting column names frompg_attribute.attname. The manual quotation wrapping does **not** escape embedded double quotes by doubling them (the correct quote_ident()behaviour). Apartman_userwho owns a template table can create a column whoseattnamecontains a"` character, and when the BGW (superuser) re-applies the PK to a new child partition, the quoted identifier breaks out — enabling injection of arbitrary DDL executed in the BGW superuser session.
Vulnerability Information
- Product / Framework: PostgreSQL pg_partman
- Vendor Domain: www.postgresql.org
- Vulnerability Type: SQL Injection
- CVE Details: View Full CVE Details →