CVE-2012-1618 Unescaped parameters in the PostgreSQL JDBC driver

What is CVE-2012-1618?

CVE-2012-1618 is a high-severity SQL injection vulnerability in Postgresql Postgresql, published on 6 Oct 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.

Which versions are affected by CVE-2012-1618?

2 open source packages ship an affected version, including org.postgresql:postgresql. It affects 2 products.

Products include Postgresql Postgresql, Postgresql Postgresql Jdbc Driver.

How do I fix CVE-2012-1618?

Upgrade org.postgresql:postgresql to 8.2 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2012-1618 being exploited?

There is no known exploitation of CVE-2012-1618 in the wild and no public exploit code.

Other vulnerabilities in Postgresql Postgresql

• CVE-2013-1902 Information disclosure in n/a Critical 10.0
• CVE-2013-1903 Information disclosure in n/a Critical 10.0
• CVE-2007-3279 Privilege escalation in n/a Critical 10.0
• CVE-2002-1399 Integer overflow in n/a Critical 10.0
• CVE-2016-3065 Information disclosure in n/a Critical 9.1

All Postgresql Postgresql vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h86w-m5rm-xr33.