Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← back | CVE Intelligence

CVE-2026-17543 [High]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-17543.

Vendor
PHP Group
Product
PHP ext-pgsql
Affected versions
PHP 8.2.x < 8.2.33; 8.3.x < 8.3.33; 8.4.x < 8.4.24; 8.5.x < 8.5.9
CVSS
8.1
Coverage Span
2026-08-06
Reports
1 related reports

Associated Reports & Timeline

1.
CVE-2026-17543 PoC: PHP ext-pgsql SQL injection via backslash breakout
github.com | tool | | original ↗ | #public-poc | #data-exposure | #php | #privilege-escalation
A PoC for CVE-2026-17543, a critical SQL injection in PHP's ext-pgsql: pg_* functions wrap escaped values as E'...' literals, so a backslash breaks out; the lab reads rows and sets an admin flag.
Why it matters: The flaw breaks application trust in ext-pgsql conversion helpers, allowing unauthenticated remote input to become data disclosure or application-level privilege manipulation. Upgrade to the fixed PHP release for the active branch and prefer true parameterized queries.