CVE-2007-3280
PostgreSQL 8.1 - Authenticated Remote Code Execution via Database Link Library
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-3280.
PoCs published by denuwanjayasekara, midnitesnake, egypt, todb, lucipher, including Metasploit module exploits/linux/postgres/postgres_payload.
AI-analyzed exploit summary This repository contains detailed exploitation reports for CVE-2019-0708 (BlueKeep), a critical RCE vulnerability in Microsoft's Remote Desktop Services. It includes in-depth analysis, reproduction steps, and mitigation strategies, but no actual exploit code.
Description
The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access.
Exploits (2)
This repository contains detailed exploitation reports for CVE-2019-0708 (BlueKeep), a critical RCE vulnerability in Microsoft's Remote Desktop Services. It includes in-depth analysis, reproduction steps, and mitigation strategies, but no actual exploit code.
This Metasploit module exploits PostgreSQL's ability to load user-defined functions (UDFs) from shared libraries in /tmp, allowing arbitrary code execution via a compiled .so file uploaded through binary injection. It targets Linux systems with PostgreSQL installations where the postgres service account has write access to /tmp.