Skip to content
CVE-2023-25157 PoC: GeoServer jsonArrayContains SQL injection to PostgreSQL RCE
gist.github.com | tool | CVE-2023-25157 | #rce | #public-poc | #sql-injection | #geoserver | #postgresql | #exploit | #cve | #poc | #cve-2023-25157
Summary
A Python PoC for CVE-2023-25157 that exploits SQL injection in GeoServer's WFS jsonArrayContains filter, supporting blind extraction and, with sufficient PostgreSQL privileges, OS command execution.
Why it matters
The PoC extends an unauthenticated remote SQL injection into database enumeration, data exfiltration, and conditional host command execution. Upgrade to an official fixed release, enforce least privilege for the GeoServer database account, and remove unnecessary PostgreSQL program-execution privileges.
- Vendor
- OSGeo
- Product
- GeoServer
- Affected versions
- 2.18.x < 2.18.7; 2.19.x < 2.19.7; 2.20.x < 2.20.7; 2.21.x < 2.21.4; 2.22.0-2.22.1
- CVSS
- 9.8
- Published
- Collected