PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-17543 PoC: PHP ext-pgsql SQL injection via backslash breakout

github.com | tool | CVE-2026-17543 | #public-poc | #data-exposure | #php | #privilege-escalation | #sql-injection | #postgresql | #exploit | #poc | #cve-2026-17543 | #pgsql | #escape-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A PoC for CVE-2026-17543, a critical SQL injection in PHP's ext-pgsql: pg_* functions wrap escaped values as E'...' literals, so a backslash breaks out; the lab reads rows and sets an admin flag.

Why it matters

The flaw breaks application trust in ext-pgsql conversion helpers, allowing unauthenticated remote input to become data disclosure or application-level privilege manipulation. Upgrade to the fixed PHP release for the active branch and prefer true parameterized queries.
CVE
CVE-2026-17543
Vendor
PHP Group
Product
PHP ext-pgsql
Affected versions
PHP 8.2.x < 8.2.33; 8.3.x < 8.3.33; 8.4.x < 8.4.24; 8.5.x < 8.5.9
CVSS
8.1
Published
Collected

Related coverage

tool · github.com
PoC for CVE-2026-67401: cPanel/WHM EmailTrack SQL Injection Leading to Root RCE
cPanel is widely used in shared web hosting environments. This vulnerability allows low-privileged tenants with mail permissions to achieve full host takeover as root. Administrators should urgently patch cPanel to the latest builds across all supported series.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
tool · gist.github.com
CVE-2023-25157 PoC: GeoServer jsonArrayContains SQL injection to PostgreSQL RCE
The PoC extends an unauthenticated remote SQL injection into database enumeration, data exfiltration, and conditional host command execution. Upgrade to an official fixed release, enforce least privilege for the GeoServer database account, and remove unnecessary PostgreSQL program-execution privileges.
Medium · vulnerability · github.com
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back