Skip to content
CVE-2026-17543 PoC: PHP ext-pgsql SQL injection via backslash breakout
github.com | tool | CVE-2026-17543 | #public-poc | #data-exposure | #php | #privilege-escalation | #sql-injection | #postgresql | #exploit | #poc | #cve-2026-17543 | #pgsql | #escape-bypass
Summary
A PoC for CVE-2026-17543, a critical SQL injection in PHP's ext-pgsql: pg_* functions wrap escaped values as E'...' literals, so a backslash breaks out; the lab reads rows and sets an admin flag.
Why it matters
The flaw breaks application trust in ext-pgsql conversion helpers, allowing unauthenticated remote input to become data disclosure or application-level privilege manipulation. Upgrade to the fixed PHP release for the active branch and prefer true parameterized queries.
- Vendor
- PHP Group
- Product
- PHP ext-pgsql
- Affected versions
- PHP 8.2.x < 8.2.33; 8.3.x < 8.3.33; 8.4.x < 8.4.24; 8.5.x < 8.5.9
- CVSS
- 8.1
- Published
- Collected