Collected research

SQL Injection and Postgres — An adventure to eventual RCE

Denis Andzakovic · Pulse Security

Develops PostgreSQL techniques for exploiting a constrained ORDER BY injection, including conditional expressions and error-based XML exfiltration. With superuser database access, large objects write server files and a modified SSL passphrase command turns a configuration reload into code execution.

Record

Researcher

Denis Andzakovic

Published by

Pulse Security

In the archive

• Collected in the 2020 research round

Tags

• sqli
• database
• file-write
• rce
• command-injection
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Denis Andzakovic, first published at the original source. Preserved copies are kept so the citation survives its host.