---
id: 6543
title: "CVE-2023-25157 PoC: GeoServer jsonArrayContains SQL injection to PostgreSQL RCE"
cve: CVE-2023-25157
cvss: 9.8
vendor: "OSGeo"
product: "GeoServer"
affected_versions: "2.18.x < 2.18.7; 2.19.x < 2.19.7; 2.20.x < 2.20.7; 2.21.x < 2.21.4; 2.22.0-2.22.1"
source_domain: gist.github.com
source_url: "https://gist.github.com/portbuster1337/70d75ec246b85e3199037ce212ff1a06"
published_at: "2026-08-13T21:11:41Z"
tags: ["rce", "public-poc", "sql-injection", "geoserver", "postgresql", "exploit", "cve", "poc", "cve-2023-25157"]
phying_url: "https://phying.com/item/6543"
lang: en
---

# CVE-2023-25157 PoC: GeoServer jsonArrayContains SQL injection to PostgreSQL RCE

## Summary

A Python PoC for CVE-2023-25157 that exploits SQL injection in GeoServer's WFS jsonArrayContains filter, supporting blind extraction and, with sufficient PostgreSQL privileges, OS command execution.

## Why it matters

The PoC extends an unauthenticated remote SQL injection into database enumeration, data exfiltration, and conditional host command execution. Upgrade to an official fixed release, enforce least privilege for the GeoServer database account, and remove unnecessary PostgreSQL program-execution privileges.

## Intelligence Metadata

- **Sources:** gist.github.com
- **CVE:** CVE-2023-25157
- **CVSS:** 9.8
- **Vendor:** OSGeo
- **Product:** GeoServer
- **Affected versions:** 2.18.x < 2.18.7; 2.19.x < 2.19.7; 2.20.x < 2.20.7; 2.21.x < 2.21.4; 2.22.0-2.22.1
- **Published:** 2026-08-13T21:11:41Z
- **Original:** https://gist.github.com/portbuster1337/70d75ec246b85e3199037ce212ff1a06
- **Phying News:** https://phying.com/item/6543