CVE-2017-16082

EIP tracks 1 public exploit for CVE-2017-16082. PoCs published by nulldreams.

AI-analyzed exploit summary This repository contains a working proof-of-concept for CVE-2017-16082, demonstrating remote code execution in the 'pg' Node.js PostgreSQL client via crafted column names. The exploit leverages unsafe SQL query handling to inject JavaScript code execution.

A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.