Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Attackers can exploit this vulnerability to execute arbitrary SQL statements and achieve arbitrary code execution (ACE) by leveraging psql’s meta-command functionality. Organizations using PostgreSQL should act swiftly to patch their systems and review their security protocols to prevent exploitation of such vulnerabilities in the future. Exploitation can lead to significant risks, including unauthorized database access and full system compromise through shell command execution. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. The discovery highlights the interconnected nature of these vulnerabilities, as successful exploitation of CVE-2024-12356 required leveraging CVE-2025-1094 in all tested scenarios. The PostgreSQL Global Development Group has issued advisories detailing the fixes and providing guidance on security practices. Meta-commands, identified by the exclamation mark (!), allow the execution of operating system shell commands directly from the interactive tool. A Metasploit module targeting CVE-2025-1094 has been developed, enabling exploitation against vulnerable BeyondTrust systems. She is covering various cyber security incidents happening in the Cyber Space. CVE-2025-1094 plays a critical role in enabling remote code execution via CVE-2024-12356. This vulnerability was found by Stephen Fewer, Principal Security Researcher at Rapid7.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 14 Feb 2025 07:30:57 +0000