Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← back | CVE Intelligence

CVE-2023-25157 [Critical]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2023-25157.

Vendor
OSGeo
Product
GeoServer
Affected versions
2.18.x < 2.18.7; 2.19.x < 2.19.7; 2.20.x < 2.20.7; 2.21.x < 2.21.4; 2.22.0-2.22.1
CVSS
9.8
Coverage Span
2026-08-13
Reports
1 related reports

Associated Reports & Timeline

1.
CVE-2023-25157 PoC: GeoServer jsonArrayContains SQL injection to PostgreSQL RCE
gist.github.com | tool | | original ↗ | #rce | #public-poc | #sql-injection | #geoserver
A Python PoC for CVE-2023-25157 that exploits SQL injection in GeoServer's WFS jsonArrayContains filter, supporting blind extraction and, with sufficient PostgreSQL privileges, OS command execution.
Why it matters: The PoC extends an unauthenticated remote SQL injection into database enumeration, data exfiltration, and conditional host command execution. Upgrade to an official fixed release, enforce least privilege for the GeoServer database account, and remove unnecessary PostgreSQL program-execution privileges.