---
id: 6545
title: "CVE-2026-17543 PoC: PHP ext-pgsql SQL injection via backslash breakout"
cve: CVE-2026-17543
cvss: 8.1
vendor: "PHP Group"
product: "PHP ext-pgsql"
affected_versions: "PHP 8.2.x < 8.2.33; 8.3.x < 8.3.33; 8.4.x < 8.4.24; 8.5.x < 8.5.9"
source_domain: github.com
source_url: "https://github.com/hunt-benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout"
published_at: "2026-08-06T17:05:08Z"
tags: ["public-poc", "data-exposure", "php", "privilege-escalation", "sql-injection", "postgresql", "exploit", "poc", "cve-2026-17543", "pgsql", "escape-bypass"]
phying_url: "https://phying.com/item/6545"
lang: en
---

# CVE-2026-17543 PoC: PHP ext-pgsql SQL injection via backslash breakout

## Summary

A PoC for CVE-2026-17543, a critical SQL injection in PHP's ext-pgsql: pg_* functions wrap escaped values as E'...' literals, so a backslash breaks out; the lab reads rows and sets an admin flag.

## Why it matters

The flaw breaks application trust in ext-pgsql conversion helpers, allowing unauthenticated remote input to become data disclosure or application-level privilege manipulation. Upgrade to the fixed PHP release for the active branch and prefer true parameterized queries.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-17543
- **CVSS:** 8.1
- **Vendor:** PHP Group
- **Product:** PHP ext-pgsql
- **Affected versions:** PHP 8.2.x < 8.2.33; 8.3.x < 8.3.33; 8.4.x < 8.4.24; 8.5.x < 8.5.9
- **Published:** 2026-08-06T17:05:08Z
- **Original:** https://github.com/hunt-benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout
- **Phying News:** https://phying.com/item/6545