Collected research
World of SELECT-only PostgreSQL Injections
A Go app's SELECT-only injection cannot stack queries because the pgx driver prepares every statement, but the database user holds lo_import/lo_export. Those read the pg_authid filenode off disk; a custom filenode editor flips the rol* superuser bytes offline, lo_export writes it back, and creating a 128MB large object evicts the table from shared buffers so the edit takes effect. As superuser, rewriting postgresql.conf to preload an attacker .so yields a reverse shell.
Record
- Researcher
- Maksym Vatsyk
- Published by
- Phrack
- Date
- Topic
- Injection
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Maksym Vatsyk, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .